[DO NOT MERGE]: citynode.app

[elliotBraem]

Summary

Three primitives layered onto the bos CLI + deploy workflow so the deploy loop is harder to misconfigure and easier to recover from:

1. Per-account/gateway deploy lock in FastKV (apps/<account>/<gateway>/lock/deploy.json). Acquired before publish, released in a finally block after publish confirmation. Concurrent dispatches now fail fast with status: "locked" and a conflict payload (owner, nonce, expires, txHash). bos publish keeps 10 min default; bos deploy uses 25 min default to cover publish + Railway redeploy. Override either with BOS_DEPLOY_LOCK_TTL_MS. Opt out per command with --no-deploy-lock.

2. bos infra export that emits the resolved CI infra plan (env + services + account + gateway + project + generatedAt as JSON). Backed by buildCiInfraPlan(runtimeConfig, opts) in cli/infra.ts so the source of truth is the same place that already knows port assignments for api/auth/plugin Postgres + Redis. deploy.yml now consumes this in one step (bun run bos infra export --target ci --network mainnet > .ci-infra.json) and feeds $GITHUB_ENV from the resulting JSON, dropping the duplicated API_DATABASE_URL / AUTH_DATABASE_URL / CORS_ORIGIN literals.

3. buildOriginMap reads the resolved runtime config (runtimeConfig.auth?.extendsRef + runtimeConfig.plugins[id].extendsRef) instead of re-parsing raw bos.config.json. Both fields are populated by the existing config resolution path (config.ts:833/1062), so the helper is now side-effect-free with respect to disk I/O. ~30 lines deleted.

Operator surface

• bos deploy --no-deploy-lock — opt out of lock acquisition.
• bos deploy lock inspect — print active lock (owner, nonce, expires, txHash).
• bos deploy lock release — force-clear a stuck lock.
• bos infra export [--target ci|local] [--network mainnet|testnet] — emit JSON to stdout.

Test status

• Typecheck: clean.
• bun run lint: clean (3 warnings, 10 infos — pre-existing).
• 335 unit tests pass (12 new + 4 new TTL tests), same 3 pre-existing failures (typechecks api/ui with zero unexpected errors, completes init cleanly…) that predate this branch.

Changeset

.changeset/deploy-lock-and-infra-export.md (minor bump for everything-dev).

Files

M  .github/workflows/deploy.yml
M  packages/everything-dev/src/cli.ts
A  packages/everything-dev/src/cli/deploy-lock.ts
M  packages/everything-dev/src/cli/infra.ts
M  packages/everything-dev/src/contract.meta.ts
M  packages/everything-dev/src/contract.ts
M  packages/everything-dev/src/plugin.ts
M  packages/everything-dev/src/publish.ts
A  packages/everything-dev/tests/unit/deploy-lock.test.ts
A  packages/everything-dev/tests/unit/infra-export.test.ts
A  .changeset/deploy-lock-and-infra-export.md
M  ui/src/routes/_layout/_authenticated/stake.tsx  (biome auto-fix: missing semicolon)

Open follow-ups (out of scope for this PR)

• Move the railway redeploy step inside bos deploy so child workflows shrink to one CLI call (bun run bos deploy --network mainnet --service app) and the lock spans publish + Railway. Requires the template deploy.yml regeneration.