feat!: v1.0.0 — the self engine is the only engine

[Viserion77]

Removes the LocalStack backend and the serverless-lss plugin, leaving one in-process
AWS emulator — no Docker, no container, no auth token. This is the 2.0.0 release.

285 files, +17,926 / −22,370 — a net −4,444 lines. v1 is mostly subtraction.

Migration: docs/MIGRATION-v1.md. A project already on
engine: "self" only deletes a few config keys.

Why this is safe to merge

The removal was decided on evidence, not preference. Both shipped LocalStack examples
were run end to end against the self engine first:

• localstack-ultimate (45 resources, eu-west-1) — REST payload-v1 routes, DynamoDB
  composite key + GSI + stream, SQS with DLQ redrive at maxReceiveCount: 3, SNS Publish
  from a stream handler, EventBridge bus with a pattern rule, a rate(2 minutes) schedule,
  an S3 notification with a prefix filter, an OpenSearch Serverless catalog. Every path
  fired, zero errors.
• localstack-free — REST v1 authorizer, httpApi v1 simple-response authorizer in
  TypeScript, cross-service authorizer resolved by ARN.

Nothing the project supported on LocalStack needed LocalStack.

⚠️ Please review this first

POST /api/services/install accepted any absolute directory and any command whose first
whitespace token was whitelisted. node -e "<js>" and npm exec -- <anything> pass that
check, and the endpoint returns the command's output — on a server that binds all
interfaces with permissive CORS, that was an execution and exfiltration primitive.

Both preparation endpoints now confine servicePath to the project root, and the install
command is validated by shape (package manager + install verb + flags, no positionals),
so those forms are unrepresentable rather than discouraged. Found in review before release;
the endpoints are new in this branch, so nothing released was ever exposed.

Breaking changes

• LocalStack backend removed: localstack-backend.ts, localstack-manager.ts,
  aoss-sidecar.ts and the EngineBackend interface. EngineManager owns the one engine.
• serverless-lss plugin retired (packages/serverless-plugin/, published separately).
  Services no longer announce themselves from inside sls package — a bare
  POST /api/services/register { servicePath } is a complete registration. Every
  plugins: - serverless-lss entry and custom.orchestrator block is dead config;
  custom.lss stays, now read server-side.
• Config keys gone: engine, mode, localstackPort, localstackEndpoint,
  localstackEdition, localstackVersion, localstackImage, localstackAuthToken,
  services, aossSidecar — PUT /api/config answers unknown config key.
• Env vars gone: LSS_LOCALSTACK_*, LOCALSTACK_AUTH_TOKEN, LSS_SERVICES.
• CLI flags gone: --self-engine, --external, --pro, --localstack-token.
• API fields gone: GET /api/health → localstack (use engineRunning);
  GET /api/config → the localstack block, aossSidecar, services. LssClient:
  HealthStatus.localstack and lifecycle.start({ external, pro, localstackToken }).
• serverless-offline compatibility gone: custom.serverless-offline.httpPort/lambdaPort
  are no longer read as port fallbacks — declare custom.lss.apiPort/invokePort.
• Examples removed: examples/localstack-free, examples/localstack-ultimate (760 MB).
  Their raw AWS::ApiGatewayV1::* cross-stack topology survives at
  tests/integration/fixtures/apigw-raw/, where its end-to-end test still runs.

What's new

• One port for everything — dashboard, REST API and the AWS wire protocols share one
  listener on 14566. Requests carrying positive AWS evidence (SigV4 Authorization,
  X-Amz-Target, any x-amz-* header, /_aoss, /2015-03-31/) demux to the engine,
  the rest to the dashboard. AWS_ENDPOINT, the dashboard URL and the registration URL
  are now the same string.
• Lazy Lambdas — lambdaRuntime.lazy forks on first invocation, idleTimeoutMs (60 s)
  unloads when quiet, maxWarmWorkers (1/GB, clamped 2–12) caps residency. Measured on
  40 services / 400 lambdas / 400 tables: 2.0 GB → 128 MB at rest, ~20 ms cold start.
• Guided onboarding — a 3-step flow (ports → branding → project scan) that takes a
  freshly cloned monorepo to registered without a terminal. This is the plugin's
  replacement for humans.
• Service discovery — GET /api/services/scan + lss scan / lss register [path...],
  also exposed to code (LssClient.services.scan()) and to agents (MCP).
• MCP server (lss mcp) — the running stack as 25 tools over hand-rolled JSON-RPC 2.0
  on stdio, zero new dependencies, off until a client is configured. See docs/MCP.md.
• Three languages (en / pt-BR / es) in dashboard and CLI, hand-rolled and
  dependency-free. Also fixes CLI output that printed Brazilian Portuguese regardless of
  environment.
• Live load panel on the Overview — resident workers against the ceiling, what ran in
  the last 1/2/10 min, how much overlapped, and what it costs the host. Parallelism is the
  peak per bucket, not the average, because an average hides the burst that saturates
  a laptop.
• Official AWS service icons — 64 marks from AWS's Architecture Service Icons pack,
  vendored and registered into the TreeUI registry. A screen listing eight AWS services no
  longer distinguishes them by a database/inbox/target vocabulary.
• LSS_ENGINE_DATA_DIR — a second instance needs only LSS_DASHBOARD_PORT +
  LSS_ENGINE_PORT + LSS_ENGINE_DATA_DIR.

Also fixed

• The UI was never type-checked. src/ui/tsconfig.json extends the root config, which
  excludes src/ui — and exclude resolves against the root file, so the dashboard
  excluded itself from its own project and vue-tsc --noEmit silently checked nothing.
  12 real pre-existing errors surfaced and were fixed.
• Per-service overrides were unreachable when the config file was not in the project
  root (symlinked checkout, config loaded from ~) — two spellings of the same key.
• installed in the scan lied in a workspaces monorepo — it checked the service's own
  node_modules, which a hoisted workspace package legitimately lacks.

Verification

• validate: pre-prod green: lint (0 errors), 4× tsc, vue-tsc, build.
• 2,535 unit tests, 99 suites, 100% coverage (statements / branches / functions / lines).
• The integration suite now runs everywhere — it boots an isolated orchestrator on the
  self engine instead of a LocalStack container: 19 end-to-end assertions in ~20 s,
  unconditional locally and in CI. Under v1 it skipped itself whenever the LocalStack token
  was absent, which was most of the time — the project's only end-to-end coverage usually
  did not run.

Reviewing 285 files

Most of the diff is deletion and mechanical rename (LocalStack → engine) across tests and
docs. The parts worth real attention:

1. src/server/routes/services.ts — the install/package endpoint hardening above.
2. src/server/services/engine-manager.ts — the single-engine lifecycle.
3. src/server/index.ts — the single-listener demux on 14566.
4. src/server/services/lambda-runtime-manager.ts — lazy forking, idle unload, residency cap.
5. docs/MIGRATION-v1.md — is the removal list complete for a real v1 user?

Dependabot

Merging closes #30, #33 and #34 automatically: examples/localstack-ultimate no longer
exists, velocityjs is no longer in any lockfile, and fast-uri is now 3.1.4 across all
six lockfiles that carry it. #32 (adm-zip) is already satisfied on main and is stale
independently of this branch.

Note for follow-up: .github/dependabot.yml configures only the devcontainers
ecosystem, so these npm PRs come from security updates and are ungrouped and unthrottled.
npm audit on the root still reports 3 advisories in dev tooling (js-yaml,
brace-expansion, @babel/core) — all npm audit fix-able, all out of scope here.

[Copilot]

Copilot wasn't able to review this pull request because it exceeds the maximum number of lines (20,000). Try reducing the number of changed lines and requesting a review from Copilot again.