everything-dev/dist/contract.mjs

A consolidated product package for building Module Federation apps with oRPC APIs.

import { BosConfigInputSchema, BosConfigSchema, SourceModeSchema, StarterLevelSchema } from "./types.mjs";
import { oc } from "./sdk.mjs";
import { isValidImageDigest } from "./services/deploy/image.mjs";
import * as z$1 from "zod";
import "@orpc/openapi/extensions/route";

//#region src/contract.ts
const PhaseTimingSchema = z$1.object({
	name: z$1.string(),
	durationMs: z$1.number()
});
const DevOptionsSchema = z$1.object({
	host: SourceModeSchema.default("local"),
	ui: SourceModeSchema.default("local"),
	api: SourceModeSchema.default("local"),
	auth: SourceModeSchema.default("local"),
	remotePlugins: z$1.array(z$1.string()).optional().describe("Comma-separated plugin IDs to force remote (e.g. --remote-plugins auth,registry)"),
	proxy: z$1.boolean().default(false),
	ssr: z$1.boolean().default(false),
	port: z$1.number().optional(),
	apiPort: z$1.number().optional(),
	uiPort: z$1.number().optional(),
	authPort: z$1.number().optional(),
	pluginPortStart: z$1.number().optional(),
	interactive: z$1.boolean().optional(),
	logLevel: z$1.enum([
		"error",
		"warn",
		"info",
		"debug"
	]).optional().describe("Log tail level: error, warn (default), info, or debug (overrides BOS_LOG_LEVEL; the file always gets everything)")
});
const DevResultSchema = z$1.object({
	status: z$1.enum(["started", "error"]),
	description: z$1.string(),
	processes: z$1.array(z$1.string()),
	timings: z$1.array(PhaseTimingSchema).optional(),
	session: z$1.custom().optional()
});
const StartOptionsSchema = z$1.object({
	port: z$1.number().optional(),
	interactive: z$1.boolean().optional(),
	account: z$1.string().optional().describe("New project NEAR account (auto-derived from extends)"),
	domain: z$1.string().optional(),
	env: z$1.enum(["production", "staging"]).default("production").describe("Environment: production or staging"),
	registry: z$1.string().optional().describe("Override FastKV registry contract account (defaults: dev.everything.near / dev.allthethings.testnet)"),
	configPath: z$1.string().optional().describe("Boot from a local bos config file — skips FastKV resolution and SRI integrity verification")
});
const StartResultSchema = z$1.object({
	status: z$1.enum(["running", "error"]),
	url: z$1.string(),
	error: z$1.string().optional(),
	session: z$1.custom().optional(),
	summary: z$1.custom().optional()
});
const BuildOptionsSchema = z$1.object({
	packages: z$1.string().default("all").describe("Comma-separated keys, 'all' (default), or 'local' (only this repo's local plugins hosted via 'local:…')"),
	force: z$1.boolean().default(false).describe("Allow pre-Phase-A snapshots without verifiable manifest pins (their bytes were overwritten in place)")
});
const BuildResultSchema = z$1.object({
	status: z$1.enum(["success", "error"]),
	error: z$1.string().optional(),
	built: z$1.array(z$1.string()),
	skipped: z$1.array(z$1.string()).optional()
});
const ConfigOptionsSchema = z$1.object({ full: z$1.boolean().default(false).describe("Print the fully resolved configuration") });
const ConfigResultSchema = z$1.object({
	config: z$1.union([BosConfigInputSchema, BosConfigSchema]).nullable(),
	packages: z$1.array(z$1.string()),
	remotes: z$1.array(z$1.string()),
	full: z$1.boolean().default(false)
});
const RegistryUseOptionsSchema = z$1.object({
	from: z$1.string().describe("Published runtime to compose from (account/gateway or bos:// URL)"),
	sections: z$1.array(z$1.string()).min(1).describe("Sections to compose: app.ui, app.host, app.api, app.auth, plugins.<key>"),
	dryRun: z$1.boolean().default(false).describe("Preview the merged config without writing")
});
const RegistryUseResultSchema = z$1.object({
	status: z$1.enum([
		"updated",
		"dry-run",
		"error"
	]),
	from: z$1.string(),
	applied: z$1.array(z$1.string()),
	configPath: z$1.string().optional(),
	error: z$1.string().optional()
});
const PluginAddOptionsSchema = z$1.object({
	source: z$1.string().describe("Plugin source (local:path, bos://account/domain, or URL)"),
	as: z$1.string().optional().describe("Plugin alias"),
	production: z$1.string().optional().describe("Production URL override")
});
const PluginAddResultSchema = z$1.object({
	status: z$1.enum(["added", "error"]),
	key: z$1.string(),
	development: z$1.string().optional(),
	production: z$1.string().optional(),
	integrity: z$1.string().optional(),
	version: z$1.string().optional().describe("Block height (or timestamp) of the snapshot from the listing"),
	error: z$1.string().optional()
});
const PluginRemoveOptionsSchema = z$1.object({ key: z$1.string() });
const PluginRemoveResultSchema = z$1.object({
	status: z$1.enum(["removed", "error"]),
	key: z$1.string(),
	error: z$1.string().optional()
});
const PluginListResultSchema = z$1.object({
	status: z$1.enum(["listed", "error"]),
	plugins: z$1.array(z$1.object({
		key: z$1.string(),
		development: z$1.string().optional(),
		production: z$1.string().optional(),
		localPath: z$1.string().optional(),
		source: z$1.enum(["local", "remote"]),
		integrity: z$1.string().optional(),
		version: z$1.string().optional(),
		name: z$1.string().optional()
	})),
	error: z$1.string().optional()
});
const PluginPublishOptionsSchema = z$1.object({ key: z$1.string() });
const PluginPublishResultSchema = z$1.object({
	status: z$1.enum(["published", "error"]),
	key: z$1.string(),
	path: z$1.string().optional(),
	production: z$1.string().optional(),
	version: z$1.string().optional().describe("Block height (or timestamp) of the snapshot from the listing"),
	fingerprint: z$1.string().optional(),
	error: z$1.string().optional()
});
const WorkspaceDeployResultSchema = z$1.object({
	key: z$1.string(),
	kind: z$1.enum(["app", "plugin"]),
	success: z$1.boolean(),
	error: z$1.string().optional(),
	durationMs: z$1.number().optional(),
	/** Build warnings captured from the workspace's own build output —
	* attributed here, never streamed as raw interleaved stderr. */
	warnings: z$1.array(z$1.string()).default([])
});
const PublishOptionsSchema = z$1.object({
	dryRun: z$1.boolean().default(false).describe("Preview what would be published without writing"),
	verbose: z$1.boolean().default(false).describe("Show full build output instead of clean summary"),
	network: z$1.enum(["mainnet", "testnet"]).optional().describe("NEAR network: mainnet or testnet"),
	privateKey: z$1.string().optional(),
	wallet: z$1.boolean().default(false).describe("Publish gaslessly with a one-time wallet approval (NEP-366 delegate action relayed by the platform relayer)"),
	env: z$1.enum(["production", "staging"]).default("production").describe("Environment: production or staging"),
	registry: z$1.string().optional().describe("Override FastKV registry contract account (defaults: dev.everything.near / dev.allthethings.testnet)")
});
const RollbackOptionsSchema = z$1.object({
	listOnly: z$1.boolean().default(false),
	version: z$1.string().optional(),
	previous: z$1.boolean().default(false).describe("Roll back to the write immediately before the current one"),
	force: z$1.boolean().default(false).describe("Allow pre-Phase-A snapshots without verifiable manifest pins (their bytes were overwritten in place)"),
	limit: z$1.number().int().min(1).max(200).default(20).describe("Listing depth (1-200, default 20)"),
	dryRun: z$1.boolean().default(false).describe("Preview the rollback without publishing"),
	verbose: z$1.boolean().default(false).describe("Show full build output instead of clean summary"),
	network: z$1.enum(["mainnet", "testnet"]).optional().describe("NEAR network: mainnet or testnet"),
	privateKey: z$1.string().optional(),
	wallet: z$1.boolean().default(false).describe("Publish gaslessly with a one-time wallet approval (NEP-366 delegate action relayed by the platform relayer)"),
	env: z$1.enum(["production", "staging"]).default("production").describe("Environment: production or staging"),
	registry: z$1.string().optional().describe("Override FastKV registry contract account (defaults: dev.everything.near / dev.allthethings.testnet)")
});
const RollbackHistoryEntrySchema = z$1.object({
	blockHeight: z$1.number(),
	blockTimestamp: z$1.string(),
	txHash: z$1.string().optional(),
	summary: z$1.string()
});
const RollbackSlotCheckSchema = z$1.object({
	slot: z$1.string(),
	ok: z$1.boolean(),
	reason: z$1.string().optional()
});
const RollbackResultSchema = z$1.object({
	status: z$1.enum([
		"published",
		"error",
		"dry-run",
		"list"
	]),
	registryUrl: z$1.string(),
	txHash: z$1.string().optional(),
	error: z$1.string().optional(),
	history: z$1.array(RollbackHistoryEntrySchema).optional(),
	verification: z$1.array(RollbackSlotCheckSchema).optional()
});
const PublishResultSchema = z$1.object({
	status: z$1.enum([
		"published",
		"error",
		"dry-run"
	]),
	registryUrl: z$1.string(),
	txHash: z$1.string().optional(),
	fingerprint: z$1.string().optional(),
	slotPins: z$1.record(z$1.string(), z$1.string()).optional(),
	error: z$1.string().optional(),
	built: z$1.array(z$1.string()).optional(),
	skipped: z$1.array(z$1.string()).optional(),
	deployResults: z$1.array(WorkspaceDeployResultSchema).optional()
});
const DeployOptionsSchema = z$1.object({
	statusList: z$1.boolean().default(false),
	env: z$1.enum(["production", "staging"]).default("production").describe("Environment: production or staging"),
	build: z$1.boolean().default(true).describe("Build and deploy workspaces before publish (default: true)"),
	dryRun: z$1.boolean().default(false).describe("Preview what would be deployed without writing"),
	verbose: z$1.boolean().default(false),
	packages: z$1.string().default("all").describe("Comma-separated keys, 'all' (default), or 'local' (only this repo's local plugins hosted via 'local:…')"),
	network: z$1.enum(["mainnet", "testnet"]).optional().describe("NEAR network: mainnet or testnet"),
	privateKey: z$1.string().optional(),
	service: z$1.string().optional().describe("Override Railway service name from config"),
	registry: z$1.string().optional().describe("Override FastKV registry contract account (defaults: dev.everything.near / dev.allthethings.testnet)"),
	imageDigest: z$1.string().optional().refine((digest) => digest === void 0 || isValidImageDigest(digest), { message: "image digest must be sha256:<64 hex characters>" }).describe("Digest (sha256:…) of a pre-pushed runtime image — skips the image build/push leg and pins Railway to this digest"),
	fullUpload: z$1.boolean().default(false).describe("Re-upload every dist file instead of diffing unchanged files against the previous deploy"),
	forceBuild: z$1.boolean().default(false).describe("Force every prerequisite workspace rebuild even when the content-hash staleness oracle judges them fresh"),
	smoke: z$1.boolean().default(false).describe("After publish, boot the runtime image against the just-published config and gate the Railway promotion on it — a red smoke rolls the config back to the previous snapshot")
});
const DeployManifestListEntrySchema = z$1.object({
	key: z$1.string(),
	blockHeight: z$1.number(),
	blockTimestamp: z$1.string(),
	txHash: z$1.string().optional(),
	publishedAt: z$1.string().optional()
});
const DeployLegOutcomeSchema = z$1.object({
	status: z$1.enum([
		"ok",
		"skipped",
		"failed"
	]),
	detail: z$1.string().optional()
});
const DeployResultSchema = z$1.object({
	status: z$1.enum([
		"deployed",
		"published",
		"error",
		"dry-run",
		"list"
	]),
	registryUrl: z$1.string(),
	txHash: z$1.string().optional(),
	fingerprint: z$1.string().optional(),
	slotPins: z$1.record(z$1.string(), z$1.string()).optional(),
	history: z$1.array(DeployManifestListEntrySchema).optional(),
	built: z$1.array(z$1.string()).optional(),
	skipped: z$1.array(z$1.string()).optional(),
	image: z$1.string().optional(),
	service: z$1.string().optional(),
	legs: z$1.object({
		image: DeployLegOutcomeSchema.optional(),
		smoke: DeployLegOutcomeSchema.optional(),
		railway: DeployLegOutcomeSchema.optional()
	}).optional(),
	error: z$1.string().optional(),
	deployResults: z$1.array(WorkspaceDeployResultSchema).optional()
});
const SmokeOptionsSchema = z$1.object({
	image: z$1.string().optional().describe("Runtime image ref to boot — required unless defaulted by the deploy train"),
	port: z$1.number().int().default(3e3).describe("Host port to publish the container on (default: 3000)"),
	keep: z$1.boolean().default(false).describe("Keep the container after the run (debugging)"),
	account: z$1.string().optional().describe("Registry identity — defaults to the resolved session config"),
	gateway: z$1.string().optional(),
	apiDatabaseUrl: z$1.string().optional(),
	authDatabaseUrl: z$1.string().optional(),
	env: z$1.enum(["production", "staging"]).default("production").describe("Environment: production or staging"),
	registry: z$1.string().optional().describe("Override FastKV registry contract account (defaults: dev.everything.near / dev.allthethings.testnet)")
});
const SmokeResultSchema = z$1.object({
	status: z$1.enum(["ok", "error"]),
	image: z$1.string().optional(),
	summary: z$1.string().optional(),
	diagnosis: z$1.string().optional(),
	error: z$1.string().optional()
});
const OverrideSectionSchema = z$1.enum([
	"ui",
	"api",
	"host",
	"plugins"
]);
const DEFAULT_LOGIN_EXPIRES_IN_SECONDS = 7776e3;
const DEFAULT_DEPLOY_KEY_EXPIRES_IN_SECONDS = 31536e3;
const LoginOptionsSchema = z$1.object({
	key: z$1.boolean().default(false).describe("Mint a scoped deploy key (bundles:write for the config's account/gateway), store it as the session credential, and print it for BOS_STORAGE_API_KEY — plus export the publish key for headless/CI use"),
	custody: z$1.boolean().default(false).describe("Also register an OutLayer custody wallet for custody publishes"),
	site: z$1.string().optional().describe("Override site URL hosting the CLI login page"),
	expiresIn: z$1.number().int().positive().optional().describe("Credential lifetime in seconds (default: 90 days; deploy keys with --key: 365 days)"),
	device: z$1.string().optional().describe("Device label recorded on the credential (default: hostname)"),
	env: z$1.enum(["production", "staging"]).default("production"),
	registry: z$1.string().optional()
});
const LoginResultSchema = z$1.object({
	status: z$1.enum(["logged-in", "error"]),
	siteUrl: z$1.string(),
	accountId: z$1.string().nullish(),
	expiresAt: z$1.string().nullish(),
	loginUrl: z$1.string().nullish(),
	publishKey: z$1.object({
		publicKey: z$1.string(),
		network: z$1.enum(["mainnet", "testnet"]),
		contract: z$1.string(),
		exportedTo: z$1.string()
	}).nullish(),
	deployKey: z$1.object({
		key: z$1.string(),
		account: z$1.string(),
		gateway: z$1.string()
	}).nullish(),
	custodyWallet: z$1.object({
		walletId: z$1.string(),
		nearAccountId: z$1.string(),
		network: z$1.enum(["mainnet", "testnet"]),
		handoffUrl: z$1.string().nullish()
	}).nullish(),
	outlayerCli: z$1.object({
		status: z$1.enum([
			"linked",
			"cli-missing",
			"error"
		]),
		network: z$1.enum(["mainnet", "testnet"]),
		detail: z$1.string().nullish()
	}).nullish(),
	warning: z$1.string().nullish(),
	error: z$1.string().optional()
});
const LogoutOptionsSchema = z$1.object({ configDir: z$1.string().optional().describe("Override config directory") });
const LogoutResultSchema = z$1.object({
	status: z$1.enum(["logged-out", "error"]),
	revokedApiKey: z$1.boolean(),
	removedPublishKey: z$1.boolean(),
	warning: z$1.string().nullish(),
	error: z$1.string().optional()
});
const RuntimeOverrideTargetBaseSchema = z$1.enum([
	"ui",
	"api",
	"plugins"
]);
const RuntimeOverrideTargetSchema = z$1.union([RuntimeOverrideTargetBaseSchema, z$1.string().regex(/^plugins\.(\*|[a-z0-9_-]+)$/)]);
const InitOptionsSchema = z$1.object({
	extends: z$1.string().optional().describe("Parent to extend from (e.g. bos://account/gateway or account/gateway)"),
	directory: z$1.string().optional().describe("Target directory (auto-derived from domain)"),
	account: z$1.string().optional().describe("New project NEAR account (auto-derived from extends)"),
	domain: z$1.string().optional().describe("New project domain (e.g. myapp.everything.dev)"),
	source: z$1.string().optional().describe("Local source dir (skips GitHub download)"),
	plugins: z$1.array(z$1.string()).optional().describe("Comma-separated plugin keys to include (requires --overrides=plugins)"),
	overrides: z$1.array(OverrideSectionSchema).optional().describe("Comma-separated sections to customize locally: ui,api,host,plugins"),
	level: StarterLevelSchema.optional().describe("Starter complexity: simple (public shell) or advanced (adds dashboard, orgs, admin)"),
	noInteractive: z$1.boolean().default(false).describe("Skip prompts, use flags only"),
	noInstall: z$1.boolean().default(false).describe("Skip pnpm install")
});
const InitResultSchema = z$1.object({
	status: z$1.enum(["initialized", "error"]),
	directory: z$1.string(),
	extendsRef: z$1.string(),
	account: z$1.string().optional(),
	domain: z$1.string().optional(),
	extends: z$1.string(),
	plugins: z$1.array(z$1.string()).optional(),
	overrides: z$1.array(OverrideSectionSchema).optional(),
	filesCopied: z$1.number(),
	timings: z$1.array(PhaseTimingSchema).optional(),
	targetDir: z$1.string().optional(),
	error: z$1.string().optional()
});
const SyncResultSchema = z$1.object({
	status: z$1.enum([
		"synced",
		"dry-run",
		"conflicted",
		"error"
	]),
	updated: z$1.array(z$1.string()),
	skipped: z$1.array(z$1.string()),
	added: z$1.array(z$1.string()),
	conflicted: z$1.array(z$1.string()).default([]),
	backupDir: z$1.string().optional(),
	error: z$1.string().optional()
});
const ImportOptionsSchema = z$1.object({
	workspace: z$1.string().describe("Workspace subtree path (e.g. plugins/auth)"),
	/** omitted → resolve the upstream from the authored config's extends chain */
	from: z$1.string().optional().describe("Upstream source: bos://<account>/<gateway>, <owner>/<repo>[@<ref>], GitHub URL, or local directory — defaults to the authored config's extends chain"),
	yes: z$1.boolean().default(false).describe("Apply upstream over conflicting files without prompting"),
	dryRun: z$1.boolean().default(false).describe("Preview classification and report without writing files"),
	noInstall: z$1.boolean().default(false).describe("Skip pnpm install"),
	json: z$1.boolean().default(false)
});
const ImportRouteDeltaSchema = z$1.object({
	oursOnly: z$1.array(z$1.string()),
	theirsOnly: z$1.array(z$1.string())
});
const ImportMigrationCollisionSchema = z$1.object({
	kind: z$1.literal("tag-mismatch"),
	idx: z$1.number(),
	localTag: z$1.string().optional(),
	upstreamTag: z$1.string().optional(),
	message: z$1.string()
});
const ImportMigrationAppendSchema = z$1.object({
	idx: z$1.number(),
	fromTag: z$1.string(),
	toTag: z$1.string()
});
const ImportMigrationReconciliationSchema = z$1.object({
	/** local journal tags kept verbatim (already applied, never renumbered) */
	kept: z$1.array(z$1.string()),
	/** upstream migrations renumbered and appended after the local tail */
	appended: z$1.array(ImportMigrationAppendSchema),
	/** upstream migrations matched to local entries by SQL content hash */
	contentMatched: z$1.array(z$1.string())
});
const ImportResultSchema = z$1.object({
	status: z$1.enum([
		"imported",
		"dry-run",
		"conflicts",
		"error"
	]),
	workspace: z$1.string(),
	from: z$1.string(),
	ref: z$1.string(),
	resolvedSha: z$1.string().optional(),
	/** the dereferenced upstream repository when the source was chain-resolved */
	sourceRepository: z$1.string().optional(),
	/** resolution notes (e.g. HEAD fallback when no git sha is pinned) */
	warnings: z$1.array(z$1.string()).default([]),
	added: z$1.array(z$1.string()),
	updated: z$1.array(z$1.string()),
	unchanged: z$1.array(z$1.string()).default([]),
	preservedLocal: z$1.array(z$1.string()).default([]),
	merged: z$1.array(z$1.string()).default([]),
	conflicts: z$1.array(z$1.string()).default([]),
	heldBackMigrations: z$1.array(z$1.string()).default([]),
	routeDelta: ImportRouteDeltaSchema.optional(),
	migrationCollisions: z$1.array(ImportMigrationCollisionSchema).default([]),
	migrationReconciliation: ImportMigrationReconciliationSchema.optional(),
	backupDir: z$1.string().optional(),
	reportPath: z$1.string().optional(),
	error: z$1.string().optional()
});
const UpgradeOptionsSchema = z$1.object({
	dryRun: z$1.boolean().default(false).describe("Preview changes without writing"),
	check: z$1.boolean().default(false).describe("CI check — exit 1 when updates are available"),
	/** Overwrite conflicted template files (with a backup) instead of refusing. */
	force: z$1.boolean().default(false),
	noInstall: z$1.boolean().default(false).describe("Skip pnpm install"),
	noSync: z$1.boolean().default(false).describe("Only upgrade packages, skip template sync"),
	from: z$1.enum(["v1"]).optional().describe("v1 train: audit upgrade readiness and rewrite the pre-v2 tree in place"),
	audit: z$1.boolean().default(false).describe("With --from v1: audit only — emit .bos/v2-upgrade-manifest.json, write nothing"),
	maintain: z$1.array(z$1.enum([
		"port-route-guards",
		"db-topology",
		"i18n-seam",
		"compose-seam"
	])).optional().describe("With --from v1: re-run post-upgrade maintenance steps (regression guards after sync)"),
	json: z$1.boolean().default(false),
	migrationsOnly: z$1.boolean().default(false)
});
const UpgradeAuditFindingSchema = z$1.object({
	check: z$1.string(),
	path: z$1.string(),
	severity: z$1.enum(["blocker", "warn"]),
	message: z$1.string()
});
const UpgradeAuditManifestSchema = z$1.object({
	tier: z$1.enum(["A", "B"]),
	blockerCount: z$1.number(),
	warnCount: z$1.number(),
	deleteFiles: z$1.array(z$1.string()).readonly(),
	importRewrites: z$1.array(z$1.object({
		from: z$1.string(),
		to: z$1.string(),
		files: z$1.array(z$1.string()).readonly()
	})).readonly(),
	configKeys: z$1.array(z$1.string()).readonly(),
	routerSeam: z$1.enum([
		"monolithic",
		"authored-seam",
		"unknown",
		"absent"
	]),
	authoredConfigTarget: z$1.string(),
	plugins: z$1.array(z$1.object({
		name: z$1.string(),
		hasBackend: z$1.boolean(),
		hasWeb: z$1.boolean(),
		extendsParent: z$1.boolean(),
		variables: z$1.array(z$1.string()).readonly(),
		secrets: z$1.array(z$1.string()).readonly()
	})).readonly(),
	db: z$1.object({
		schemaFile: z$1.string().nullable(),
		migrationsDir: z$1.string().nullable()
	})
});
const UpgradeResultSchema = z$1.object({
	status: z$1.enum([
		"upgraded",
		"dry-run",
		"error",
		"already-upgraded",
		"gate-blocked",
		"audit"
	]),
	packages: z$1.array(z$1.object({
		name: z$1.string(),
		from: z$1.string().optional(),
		to: z$1.string()
	})),
	sync: SyncResultSchema.optional(),
	migrated: z$1.array(z$1.string()).optional(),
	availablePlugins: z$1.array(z$1.string()).optional(),
	/** The resolved platform release manifest when one publishes (ADR 0034). */
	platform: z$1.object({
		resolved: z$1.string(),
		source: z$1.string(),
		fromCache: z$1.boolean()
	}).optional(),
	/** Dry-run/check only: whether any update is available. */
	updatesAvailable: z$1.boolean().optional(),
	selectedPlugins: z$1.array(z$1.string()).optional(),
	audit: z$1.object({
		tier: z$1.enum(["A", "B"]),
		findings: z$1.array(UpgradeAuditFindingSchema).readonly(),
		manifest: UpgradeAuditManifestSchema
	}).optional(),
	blockers: z$1.array(UpgradeAuditFindingSchema).readonly().optional(),
	notes: z$1.array(z$1.string()).optional(),
	timings: z$1.array(PhaseTimingSchema).optional(),
	changelogUrl: z$1.string().optional(),
	error: z$1.string().optional()
});
const DeployedVersionStatusSchema = z$1.object({
	publishedFingerprint: z$1.string(),
	servedFingerprint: z$1.string().optional(),
	inSync: z$1.boolean(),
	error: z$1.string().optional()
});
const StatusResultSchema = z$1.object({
	status: z$1.enum(["ok", "error"]),
	deployedVersion: DeployedVersionStatusSchema.optional(),
	extends: z$1.string().optional(),
	account: z$1.string().optional(),
	domain: z$1.string().optional(),
	packages: z$1.array(z$1.object({
		name: z$1.string(),
		installed: z$1.string().optional(),
		latest: z$1.string().optional(),
		isLinked: z$1.boolean().optional(),
		specifier: z$1.string().optional()
	})),
	lastSync: z$1.string().optional(),
	envFile: z$1.enum([
		"found",
		"missing",
		"example-only"
	]),
	parentReachable: z$1.boolean().optional(),
	error: z$1.string().optional()
});
const TypesGenOptionsSchema = z$1.object({
	env: z$1.enum(["development", "production"]).optional().describe("Environment: development (default) or production"),
	dryRun: z$1.boolean().default(false).describe("Preview what would be fetched without writing files"),
	remotePlugins: z$1.array(z$1.string()).optional().describe("Comma-separated plugin IDs to fetch contract types remotely (e.g. --remote-plugins auth,registry)")
});
const TypesGenResultSchema = z$1.object({
	status: z$1.enum(["success", "error"]),
	generated: z$1.array(z$1.string()),
	fetched: z$1.array(z$1.string()),
	skipped: z$1.array(z$1.string()),
	failed: z$1.array(z$1.string()),
	error: z$1.string().optional()
});
const DbStudioOptionsSchema = z$1.object({ plugin: z$1.string().default("api").describe("Plugin key: api, auth, or a plugin name (default: api)") });
const DbStudioResultSchema = z$1.object({
	status: z$1.enum(["success", "error"]),
	plugin: z$1.string(),
	source: z$1.enum(["local", "remote"]),
	section: z$1.string(),
	databaseSecret: z$1.string().optional(),
	databaseUrl: z$1.string().optional(),
	workspaceDir: z$1.string().optional(),
	error: z$1.string().optional()
});
const DbDoctorOptionsSchema = z$1.object({ plugin: z$1.string().describe("Plugin key: api, auth, or a plugin name") });
const DbDoctorResultSchema = z$1.object({
	status: z$1.enum(["success", "error"]),
	plugin: z$1.string(),
	slug: z$1.string(),
	journalTable: z$1.string(),
	journalSchema: z$1.string(),
	diagnosis: z$1.string(),
	localMigrationCount: z$1.number(),
	appliedHashCount: z$1.number(),
	expectedTables: z$1.array(z$1.string()),
	missingTables: z$1.array(z$1.string()),
	workspaceDir: z$1.string().optional(),
	dbSecret: z$1.string().optional(),
	dbUrl: z$1.string().optional(),
	error: z$1.string().optional()
});
const DbRepairOptionsSchema = z$1.object({
	plugin: z$1.string().describe("Plugin key: api, auth, or a plugin name"),
	mode: z$1.enum(["history-reset", "recreate"]).default("history-reset").describe("Repair mode: history-reset (default) or recreate (not yet supported)"),
	yes: z$1.boolean().optional().describe("Skip confirmation prompt")
});
const DbRepairResultSchema = z$1.object({
	status: z$1.enum([
		"repaired",
		"refused",
		"error"
	]),
	message: z$1.string(),
	diagnosis: z$1.any(),
	error: z$1.string().optional()
});
const ProcessRoleSchema = z$1.enum([
	"standalone",
	"workspace-parent",
	"workspace-child"
]);
const PidEntrySchema = z$1.object({
	pid: z$1.number(),
	configDir: z$1.string(),
	parentPid: z$1.number().optional(),
	role: ProcessRoleSchema,
	ports: z$1.object({
		host: z$1.number().optional(),
		api: z$1.number().optional(),
		ui: z$1.number().optional(),
		auth: z$1.number().optional()
	}).default({}),
	budget: z$1.object({
		min: z$1.number(),
		max: z$1.number()
	}).optional(),
	startedAt: z$1.number(),
	description: z$1.string()
});
const PsResultSchema = z$1.object({
	status: z$1.enum(["ok", "error"]),
	entries: z$1.array(PidEntrySchema),
	error: z$1.string().optional()
});
const LogsOptionsSchema = z$1.object({
	service: z$1.string().optional().describe("Filter by service name (e.g. host, api, auth, ui, plugin:votes)"),
	tail: z$1.number().int().positive().max(1e5).optional().describe("Show only the last N lines"),
	follow: z$1.boolean().optional().describe("Stream the log as lines are appended")
});
const LogsResultSchema = z$1.object({
	logFile: z$1.string(),
	lines: z$1.array(z$1.string())
});
const KillOptionsSchema = z$1.object({
	configDir: z$1.string().optional().describe("Kill processes owned by a config directory (defaults to cwd)"),
	signal: z$1.enum(["SIGTERM", "SIGKILL"]).default("SIGTERM").describe("Signal: SIGTERM (default) or SIGKILL"),
	all: z$1.boolean().default(false).describe("Kill processes across all config directories")
});
const KillResultSchema = z$1.object({
	status: z$1.enum(["killed", "error"]),
	killed: z$1.array(z$1.object({
		pid: z$1.number(),
		configDir: z$1.string()
	})),
	skipped: z$1.array(z$1.object({
		pid: z$1.number(),
		reason: z$1.string()
	})),
	error: z$1.string().optional()
});
const TypecheckOptionsSchema = z$1.object({ packages: z$1.string().default("all").describe("Comma-separated workspace list (default: all)") });
const TypecheckWorkspaceResultSchema = z$1.object({
	workspace: z$1.string(),
	passed: z$1.boolean(),
	output: z$1.string().optional(),
	error: z$1.string().optional()
});
const TypecheckResultSchema = z$1.object({
	status: z$1.enum(["success", "error"]),
	checked: z$1.array(z$1.string()),
	skipped: z$1.array(z$1.string()),
	results: z$1.array(TypecheckWorkspaceResultSchema),
	error: z$1.string().optional()
});
const MfCheckOptionsSchema = z$1.object({ timeoutMs: z$1.number().default(15e3) });
const PlatformCompatViolationSchema = z$1.object({
	kind: z$1.enum(["minChild", "shared-dep"]),
	name: z$1.string().optional(),
	message: z$1.string()
});
const MfCheckRemoteResultSchema = z$1.object({
	role: z$1.string(),
	url: z$1.string(),
	reachable: z$1.boolean(),
	pluginVersion: z$1.string().nullable(),
	ok: z$1.boolean(),
	reason: z$1.string().optional()
});
const MfCheckUiSlotSchema = z$1.object({
	slot: z$1.string(),
	url: z$1.string(),
	reachable: z$1.boolean(),
	ok: z$1.boolean(),
	reason: z$1.string().optional()
});
const MfCheckResultSchema = z$1.object({
	status: z$1.enum(["ok", "fail"]),
	hostVersion: z$1.string().nullable(),
	hostReachable: z$1.boolean(),
	hostReason: z$1.string().optional(),
	remotes: z$1.array(MfCheckRemoteResultSchema),
	/** The UI composition compat gate (#546) — present when UI slots exist. */
	ui: z$1.object({
		ok: z$1.boolean(),
		slots: z$1.array(MfCheckUiSlotSchema)
	}).optional(),
	/** The platform compat gate (ADR 0034 pt 5) — present when a release manifest resolves. */
	platform: z$1.object({
		ok: z$1.boolean(),
		violations: z$1.array(PlatformCompatViolationSchema)
	}).optional()
});
const PlatformManifestOptionsSchema = z$1.object({ check: z$1.boolean().default(false).describe("Also run the platform compat check against the local workspace") });
const PlatformManifestResultSchema = z$1.object({
	status: z$1.enum([
		"ok",
		"absent",
		"fail"
	]),
	version: z$1.string().nullable(),
	source: z$1.string().optional(),
	fromCache: z$1.boolean().optional(),
	error: z$1.string().optional(),
	/** Set when the authored `platform` pin no longer matches anything in the
	* extends chain — the root republished past it (issue #546). */
	drift: z$1.object({
		pinned: z$1.string(),
		published: z$1.string()
	}).optional(),
	compat: z$1.object({
		ok: z$1.boolean(),
		violations: z$1.array(PlatformCompatViolationSchema)
	}).optional()
});
const SecretsSetOptionsSchema = z$1.object({
	name: z$1.string().describe("Secret name (UPPER_SNAKE_CASE; BOS_* and PORT are reserved)"),
	value: z$1.string().optional().describe("Secret value — omitted: hidden prompt (TTY)"),
	site: z$1.string().optional().describe("Override the vault site (default: the session credential's site)")
});
const SecretsSetResultSchema = z$1.object({
	status: z$1.enum(["set", "error"]),
	name: z$1.string().optional(),
	siteUrl: z$1.string().optional(),
	warning: z$1.string().optional(),
	error: z$1.string().optional()
});
const SecretsListOptionsSchema = z$1.object({
	account: z$1.string().optional().describe("Target runtime account (default: the declared config)"),
	gateway: z$1.string().optional().describe("Target runtime gateway (default: the declared domain)"),
	site: z$1.string().optional()
});
const SecretsListResultSchema = z$1.object({
	status: z$1.enum(["listed", "error"]),
	secrets: z$1.array(z$1.object({
		name: z$1.string(),
		state: z$1.enum([
			"set",
			"missing",
			"undeclared"
		])
	})).optional(),
	missing: z$1.array(z$1.string()).optional(),
	siteUrl: z$1.string().optional(),
	warning: z$1.string().optional(),
	error: z$1.string().optional()
});
const SecretsRemoveOptionsSchema = z$1.object({
	name: z$1.string().describe("Secret name to remove"),
	yes: z$1.boolean().default(false).describe("Skip the confirmation prompt")
});
const SecretsRemoveResultSchema = z$1.object({
	status: z$1.enum([
		"removed",
		"not-found",
		"error"
	]),
	name: z$1.string().optional(),
	error: z$1.string().optional()
});
const commandOptionSchemas = {
	dev: DevOptionsSchema,
	start: StartOptionsSchema,
	build: BuildOptionsSchema,
	config: ConfigOptionsSchema,
	registryUse: RegistryUseOptionsSchema,
	pluginAdd: PluginAddOptionsSchema,
	pluginRemove: PluginRemoveOptionsSchema,
	pluginPublish: PluginPublishOptionsSchema,
	publish: PublishOptionsSchema,
	rollback: RollbackOptionsSchema,
	deploy: DeployOptionsSchema,
	smoke: SmokeOptionsSchema,
	login: LoginOptionsSchema,
	logout: LogoutOptionsSchema,
	init: InitOptionsSchema,
	import: ImportOptionsSchema,
	upgrade: UpgradeOptionsSchema,
	typecheck: TypecheckOptionsSchema,
	typesGen: TypesGenOptionsSchema,
	mfCheck: MfCheckOptionsSchema,
	platformManifest: PlatformManifestOptionsSchema,
	secretsSet: SecretsSetOptionsSchema,
	secretsList: SecretsListOptionsSchema,
	secretsRemove: SecretsRemoveOptionsSchema,
	dbStudio: DbStudioOptionsSchema,
	dbDoctor: DbDoctorOptionsSchema,
	dbRepair: DbRepairOptionsSchema,
	logs: LogsOptionsSchema,
	kill: KillOptionsSchema
};
const bosContract = oc.router({
	dev: oc.route({
		method: "POST",
		path: "/dev"
	}).input(DevOptionsSchema).output(DevResultSchema),
	start: oc.route({
		method: "POST",
		path: "/start"
	}).input(StartOptionsSchema).output(StartResultSchema),
	build: oc.route({
		method: "POST",
		path: "/build"
	}).input(BuildOptionsSchema).output(BuildResultSchema),
	config: oc.route({
		method: "GET",
		path: "/config"
	}).input(ConfigOptionsSchema).output(ConfigResultSchema),
	registryUse: oc.route({
		method: "POST",
		path: "/registry/use"
	}).input(RegistryUseOptionsSchema).output(RegistryUseResultSchema),
	pluginAdd: oc.route({
		method: "POST",
		path: "/plugin/add"
	}).input(PluginAddOptionsSchema).output(PluginAddResultSchema),
	pluginRemove: oc.route({
		method: "POST",
		path: "/plugin/remove"
	}).input(PluginRemoveOptionsSchema).output(PluginRemoveResultSchema),
	pluginList: oc.route({
		method: "GET",
		path: "/plugin/list"
	}).output(PluginListResultSchema),
	pluginPublish: oc.route({
		method: "POST",
		path: "/plugin/publish"
	}).input(PluginPublishOptionsSchema).output(PluginPublishResultSchema),
	publish: oc.route({
		method: "POST",
		path: "/publish"
	}).input(PublishOptionsSchema).output(PublishResultSchema),
	rollback: oc.route({
		method: "POST",
		path: "/rollback"
	}).input(RollbackOptionsSchema).output(RollbackResultSchema),
	deploy: oc.route({
		method: "POST",
		path: "/deploy"
	}).input(DeployOptionsSchema).output(DeployResultSchema),
	smoke: oc.route({
		method: "POST",
		path: "/smoke"
	}).input(SmokeOptionsSchema).output(SmokeResultSchema),
	login: oc.route({
		method: "POST",
		path: "/login"
	}).input(LoginOptionsSchema).output(LoginResultSchema),
	logout: oc.route({
		method: "POST",
		path: "/logout"
	}).input(LogoutOptionsSchema).output(LogoutResultSchema),
	init: oc.route({
		method: "POST",
		path: "/init"
	}).input(InitOptionsSchema).output(InitResultSchema),
	import: oc.route({
		method: "POST",
		path: "/import"
	}).input(ImportOptionsSchema).output(ImportResultSchema),
	upgrade: oc.route({
		method: "POST",
		path: "/upgrade"
	}).input(UpgradeOptionsSchema).output(UpgradeResultSchema),
	status: oc.route({
		method: "GET",
		path: "/status"
	}).output(StatusResultSchema),
	typesGen: oc.route({
		method: "POST",
		path: "/types/gen"
	}).input(TypesGenOptionsSchema).output(TypesGenResultSchema),
	dbStudio: oc.route({
		method: "POST",
		path: "/db/studio"
	}).input(DbStudioOptionsSchema).output(DbStudioResultSchema),
	dbDoctor: oc.route({
		method: "POST",
		path: "/db/doctor"
	}).input(DbDoctorOptionsSchema).output(DbDoctorResultSchema),
	dbRepair: oc.route({
		method: "POST",
		path: "/db/repair"
	}).input(DbRepairOptionsSchema).output(DbRepairResultSchema),
	ps: oc.route({
		method: "GET",
		path: "/ps"
	}).output(PsResultSchema),
	logs: oc.route({
		method: "GET",
		path: "/logs"
	}).input(LogsOptionsSchema).output(LogsResultSchema),
	kill: oc.route({
		method: "POST",
		path: "/kill"
	}).input(KillOptionsSchema).output(KillResultSchema),
	typecheck: oc.route({
		method: "POST",
		path: "/typecheck"
	}).input(TypecheckOptionsSchema).output(TypecheckResultSchema),
	mfCheck: oc.route({
		method: "POST",
		path: "/mf/check"
	}).input(MfCheckOptionsSchema).output(MfCheckResultSchema),
	platformManifest: oc.route({
		method: "POST",
		path: "/platform/manifest"
	}).input(PlatformManifestOptionsSchema).output(PlatformManifestResultSchema),
	secretsSet: oc.route({
		method: "POST",
		path: "/secrets/set"
	}).input(SecretsSetOptionsSchema).output(SecretsSetResultSchema),
	secretsList: oc.route({
		method: "POST",
		path: "/secrets/list"
	}).input(SecretsListOptionsSchema).output(SecretsListResultSchema),
	secretsRemove: oc.route({
		method: "POST",
		path: "/secrets/remove"
	}).input(SecretsRemoveOptionsSchema).output(SecretsRemoveResultSchema)
});
const cliCommandMeta = {
	dev: {
		commandPath: ["dev"],
		summary: "Start a development session",
		interactive: true,
		longRunning: true
	},
	start: {
		commandPath: ["start"],
		summary: "Start the production host",
		interactive: false,
		longRunning: true
	},
	build: {
		commandPath: ["build"],
		summary: "Build selected workspaces",
		interactive: false,
		fields: { packages: { positional: true } }
	},
	config: {
		commandPath: ["config"],
		summary: "Print the loaded BOS configuration",
		interactive: false
	},
	registryUse: {
		commandPath: ["registry", "use"],
		summary: "Compose app.ui/app.host/app.api/plugins.<key> sections from a published runtime into bos.config.json",
		interactive: false,
		fields: { from: { positional: true } }
	},
	pluginAdd: {
		commandPath: ["plugin", "add"],
		summary: "Add a plugin attachment",
		interactive: false,
		fields: { source: { positional: true } }
	},
	pluginRemove: {
		commandPath: ["plugin", "remove"],
		summary: "Remove a plugin attachment",
		interactive: false
	},
	pluginList: {
		commandPath: ["plugin", "list"],
		summary: "List configured plugins",
		interactive: false
	},
	pluginPublish: {
		commandPath: ["plugin", "publish"],
		summary: "Publish a single plugin",
		interactive: false
	},
	publish: {
		commandPath: ["publish"],
		summary: "Publish the current workspace configuration (no build — use bos deploy for the full train)",
		interactive: false
	},
	rollback: {
		commandPath: ["rollback"],
		summary: "Republish an earlier config snapshot from the registry publish history",
		interactive: true
	},
	deploy: {
		commandPath: ["deploy"],
		summary: "Deploy train: preflight → build → upload bundles → publish config → runtime image (pre-pushed digest or local docker build) → post-publish smoke (optional) → Railway (image-backed, no build)",
		interactive: false
	},
	smoke: {
		commandPath: ["smoke"],
		summary: "Boot a runtime image the way production boots (identity-driven, published config) and assert the boot surface: /health, SSR, OpenAPI spec, in-image mf check",
		interactive: false
	},
	login: {
		commandPath: ["login"],
		summary: "Sign in with your NEAR account via the hosted site (wallet, passkey, or social login)",
		interactive: true
	},
	logout: {
		commandPath: ["logout"],
		summary: "Revoke the stored CLI session and delete the exported publish key",
		interactive: false
	},
	init: {
		commandPath: ["init"],
		summary: "Scaffold a new project by extending a deployed app or template",
		interactive: true,
		fields: { domain: { positional: true } }
	},
	import: {
		commandPath: ["import"],
		summary: "Import a workspace subtree from an upstream repo without cloning",
		interactive: true,
		fields: { workspace: { positional: true } }
	},
	upgrade: {
		commandPath: ["upgrade"],
		summary: "Upgrade framework packages and sync template files",
		interactive: true
	},
	typesGen: {
		commandPath: ["types", "gen"],
		summary: "Generate type definitions from configured API and plugin contracts",
		interactive: false
	},
	typecheck: {
		commandPath: ["typecheck"],
		summary: "Run TypeScript type checking across all local workspaces",
		interactive: false,
		fields: { packages: { positional: true } }
	},
	mfCheck: {
		commandPath: ["mf", "check"],
		summary: "Verify Module Federation runtime compatibility across published host + plugin bundles",
		interactive: false
	},
	platformManifest: {
		commandPath: ["platform", "manifest"],
		summary: "Show the platform release manifest — the booted host or the resolved release self-describes (ADR 0034)",
		interactive: false
	},
	secretsSet: {
		commandPath: ["secrets", "set"],
		summary: "Store a runtime secret in the deploy console's vault — sealed at rest, never echoed back",
		interactive: true,
		fields: { name: { positional: true } }
	},
	secretsList: {
		commandPath: ["secrets", "list"],
		summary: "List the runtime's secrets as names + set/missing status against the declared config (never values)",
		interactive: false
	},
	secretsRemove: {
		commandPath: ["secrets", "remove"],
		summary: "Remove a runtime secret from the vault",
		interactive: true,
		fields: { name: { positional: true } }
	},
	dbStudio: {
		commandPath: ["db", "studio"],
		summary: "Open Drizzle Studio for a plugin's database",
		fields: { plugin: { positional: true } }
	},
	dbDoctor: {
		commandPath: ["db", "doctor"],
		summary: "Diagnose migration health for a plugin's database",
		fields: { plugin: { positional: true } }
	},
	dbRepair: {
		commandPath: ["db", "repair"],
		summary: "Reset migration history and reapply migrations for a plugin",
		fields: { plugin: { positional: true } }
	},
	status: {
		commandPath: ["status"],
		summary: "Show project health, versions, and update availability",
		interactive: false
	},
	ps: {
		commandPath: ["ps"],
		summary: "List tracked development processes",
		interactive: false
	},
	logs: {
		commandPath: ["logs"],
		summary: "Read dev session logs (.bos/logs/dev-latest.log)",
		interactive: false
	},
	kill: {
		commandPath: ["kill"],
		summary: "Stop tracked development processes",
		interactive: false
	}
};

//#endregion
export { BuildOptionsSchema, BuildResultSchema, ConfigOptionsSchema, ConfigResultSchema, DEFAULT_DEPLOY_KEY_EXPIRES_IN_SECONDS, DEFAULT_LOGIN_EXPIRES_IN_SECONDS, DbDoctorOptionsSchema, DbDoctorResultSchema, DbRepairOptionsSchema, DbRepairResultSchema, DbStudioOptionsSchema, DbStudioResultSchema, DeployLegOutcomeSchema, DeployManifestListEntrySchema, DeployOptionsSchema, DeployResultSchema, DeployedVersionStatusSchema, DevOptionsSchema, DevResultSchema, ImportMigrationAppendSchema, ImportMigrationCollisionSchema, ImportMigrationReconciliationSchema, ImportOptionsSchema, ImportResultSchema, ImportRouteDeltaSchema, InitOptionsSchema, InitResultSchema, KillOptionsSchema, KillResultSchema, LoginOptionsSchema, LoginResultSchema, LogoutOptionsSchema, LogoutResultSchema, LogsOptionsSchema, LogsResultSchema, MfCheckOptionsSchema, MfCheckRemoteResultSchema, MfCheckResultSchema, MfCheckUiSlotSchema, OverrideSectionSchema, PhaseTimingSchema, PidEntrySchema, PlatformCompatViolationSchema, PlatformManifestOptionsSchema, PlatformManifestResultSchema, PluginAddOptionsSchema, PluginAddResultSchema, PluginListResultSchema, PluginPublishOptionsSchema, PluginPublishResultSchema, PluginRemoveOptionsSchema, PluginRemoveResultSchema, ProcessRoleSchema, PsResultSchema, PublishOptionsSchema, PublishResultSchema, RegistryUseOptionsSchema, RegistryUseResultSchema, RollbackHistoryEntrySchema, RollbackOptionsSchema, RollbackResultSchema, RollbackSlotCheckSchema, RuntimeOverrideTargetBaseSchema, RuntimeOverrideTargetSchema, SecretsListOptionsSchema, SecretsListResultSchema, SecretsRemoveOptionsSchema, SecretsRemoveResultSchema, SecretsSetOptionsSchema, SecretsSetResultSchema, SmokeOptionsSchema, SmokeResultSchema, StartOptionsSchema, StartResultSchema, StatusResultSchema, SyncResultSchema, TypecheckOptionsSchema, TypecheckResultSchema, TypecheckWorkspaceResultSchema, TypesGenOptionsSchema, TypesGenResultSchema, UpgradeAuditFindingSchema, UpgradeAuditManifestSchema, UpgradeOptionsSchema, UpgradeResultSchema, WorkspaceDeployResultSchema, bosContract, cliCommandMeta, commandOptionSchemas };
//# sourceMappingURL=contract.mjs.map