@akanjs/cli 3.0.2 → 3.1.0-rc.1

package/pipeline.command-d0v38572.js

@@ -0,0 +1,1334 @@
+// @bun
+import {
+  Workspace,
+  runner,
+  script,
+  command
+} from "./index-6jjtnhkw.js";
+import {
+  FileSys2
+} from "./index-52w0fvh8.js";
+import {
+  AkanAppConfig,
+  AkanWorkspaceConfig,
+  AppExecutor
+} from "./index-55mynnqs.js";
+import {
+  resolveMobileTargets
+} from "./index-q958tqqg.js";
+
+// pkgs/@akanjs/cli/pipeline/pipeline.command.ts
+import { pipelineTriggers as pipelineTriggers2 } from "akanjs/common";
+
+// pkgs/@akanjs/devkit/pipeline/PipelineCompiler.ts
+import {
+  defaultAppPipeline
+} from "akanjs";
+import {
+  PipelinePattern as PipelinePattern2,
+  PipelinePlanSchema,
+  pipelineActionNames as pipelineActionNames2,
+  pipelineActions,
+  pipelineMilestones as pipelineMilestones2,
+  pipelineOtaPlatforms as pipelineOtaPlatforms2,
+  pipelinePlanVersion
+} from "akanjs/common";
+
+// pkgs/@akanjs/devkit/pipeline/PipelineInputReader.ts
+import {
+  PipelineNames,
+  PipelinePattern,
+  pipelineActionNames,
+  pipelineMilestones,
+  pipelineOtaPlatforms,
+  pipelinePlanLimits,
+  pipelineTriggers
+} from "akanjs/common";
+
+class PipelineInputReader {
+  static #futureKeys = ["cache", "artifacts", "input", "image", "services", "notify"];
+  static #durationPattern = /^(\d+)(s|m|h)$/;
+  static #stepNameChars = 80;
+  diagnostics = [];
+  #file;
+  constructor(file) {
+    this.#file = file;
+  }
+  workspace(value) {
+    const input = this.#object(value, "pipeline", ["schemaVersion", "env", "timeout", "before", "after", "post"]);
+    if (!input)
+      return null;
+    this.#schemaVersion(input.schemaVersion, "pipeline.schemaVersion");
+    const ids = new Set;
+    const stages = (key) => this.#list(input[key], `pipeline.${key}`).flatMap((stage, idx) => {
+      const rule = this.#workspaceStage(stage, `pipeline.${key}[${idx}]`);
+      if (rule)
+        this.#claimId(ids, rule.id, rule.path);
+      return rule ? [rule] : [];
+    });
+    return {
+      env: this.#env(input.env, "pipeline.env"),
+      timeoutSeconds: this.#duration(input.timeout, "pipeline.timeout"),
+      before: stages("before"),
+      after: stages("after"),
+      post: this.#post(input.post, "pipeline.post")
+    };
+  }
+  app(value) {
+    const input = this.#object(value, "pipeline", ["schemaVersion", "stages", "env", "after"]);
+    if (!input)
+      return null;
+    this.#schemaVersion(input.schemaVersion, "pipeline.schemaVersion");
+    if (input.stages === undefined)
+      this.#report("pipeline.schema.invalid", "lists no `stages`", "pipeline");
+    const ids = new Set;
+    const stages = this.#list(input.stages, "pipeline.stages").flatMap((stage, idx) => {
+      const rule = this.#appStage(stage, `pipeline.stages[${idx}]`);
+      if (rule)
+        this.#claimId(ids, rule.id, rule.path);
+      return rule ? [rule] : [];
+    });
+    return {
+      env: this.#env(input.env, "pipeline.env"),
+      after: this.#strings(input.after, "pipeline.after"),
+      stages
+    };
+  }
+  #workspaceStage(value, path) {
+    const raw = this.#object(value, path);
+    if (!raw)
+      return null;
+    if ("use" in raw) {
+      this.#report("pipeline.schema.invalid", "built-in actions are declared per app, in apps/<app>/akan.config.ts", `${path}.use`);
+      return null;
+    }
+    if ("parallel" in raw)
+      return this.#parallelStage(raw, path);
+    if ("matrix" in raw)
+      return this.#matrixStage(raw, path);
+    return this.#shellStage(raw, path, "workspace");
+  }
+  #appStage(value, path) {
+    const raw = this.#object(value, path);
+    if (!raw)
+      return null;
+    if ("parallel" in raw || "matrix" in raw) {
+      this.#report("pipeline.schema.invalid", `an app's own stage takes no \`${"parallel" in raw ? "parallel" : "matrix"}\`: it is already that app's, and parallel or per-app copies belong to the workspace root akan.config.ts`, path);
+      return null;
+    }
+    if ("use" in raw)
+      return this.#actionStage(raw, path);
+    return this.#shellStage(raw, path, "app");
+  }
+  #actionStage(raw, path) {
+    if (!this.#keys(raw, path, [
+      "use",
+      "id",
+      "name",
+      "description",
+      "milestone",
+      "when",
+      "timeout",
+      "allowFailure",
+      "retry",
+      ...raw.use === "ota" ? ["targets", "platforms"] : []
+    ]))
+      return null;
+    const action = this.#oneOf(raw.use, `${path}.use`, pipelineActionNames);
+    if (!action)
+      return null;
+    const name = raw.name === undefined ? null : this.#text(raw.name, `${path}.name`, pipelinePlanLimits.nameChars);
+    const id = raw.id === undefined ? action : this.#id(raw.id, `${path}.id`);
+    if (!id)
+      return null;
+    const attempts = raw.retry === undefined ? null : this.#int(raw.retry, `${path}.retry`, 1, pipelinePlanLimits.retryAttempts);
+    return {
+      kind: "action",
+      action,
+      id,
+      name: name ?? action,
+      named: name !== null,
+      description: this.#description(raw.description, `${path}.description`),
+      milestone: this.#milestone(raw.milestone, `${path}.milestone`),
+      when: this.#when(raw.when, `${path}.when`, false),
+      timeoutSeconds: this.#duration(raw.timeout, `${path}.timeout`),
+      allowFailure: this.#boolean(raw.allowFailure, `${path}.allowFailure`),
+      retry: attempts === null ? null : { attempts, delaySeconds: 0 },
+      targets: raw.targets === undefined ? null : this.#nonEmptySet(this.#strings(raw.targets, `${path}.targets`), `${path}.targets`),
+      platforms: raw.platforms === undefined ? null : this.#nonEmptySet(this.#list(raw.platforms, `${path}.platforms`).flatMap((platform, idx) => {
+        const parsed = this.#oneOf(platform, `${path}.platforms[${idx}]`, pipelineOtaPlatforms);
+        return parsed ? [parsed] : [];
+      }), `${path}.platforms`),
+      path
+    };
+  }
+  #nonEmptySet(items, path) {
+    if (!items.length) {
+      this.#report("pipeline.schema.invalid", "lists none: leave it out to take the default", path);
+      return null;
+    }
+    return [...new Set(items)];
+  }
+  #shellStage(raw, path, scope) {
+    const keys = [
+      "id",
+      "name",
+      "description",
+      "milestone",
+      "when",
+      "timeout",
+      "allowFailure",
+      "sh",
+      "steps",
+      "env",
+      "secrets",
+      "retry"
+    ];
+    if (!this.#keys(raw, path, keys))
+      return null;
+    const head = this.#stageHead(raw, path, scope === "workspace" ? "workspace" : "app");
+    if (!head)
+      return null;
+    const steps = this.#stageSteps(raw, path);
+    return steps ? { kind: "sh", ...head, steps } : null;
+  }
+  #matrixStage(raw, path) {
+    const keys = [
+      "id",
+      "name",
+      "description",
+      "milestone",
+      "when",
+      "timeout",
+      "allowFailure",
+      "sh",
+      "steps",
+      "env",
+      "secrets",
+      "retry",
+      "matrix",
+      "maxParallel"
+    ];
+    if (!this.#keys(raw, path, keys))
+      return null;
+    if (raw.matrix !== "apps") {
+      this.#report("pipeline.schema.invalid", `${JSON.stringify(raw.matrix)} is not a matrix axis: only "apps"`, `${path}.matrix`);
+      return null;
+    }
+    const head = this.#stageHead(raw, path, "matrix");
+    if (!head)
+      return null;
+    const steps = this.#stageSteps(raw, path);
+    if (!steps)
+      return null;
+    return { kind: "matrix", ...head, maxParallel: this.#maxParallel(raw.maxParallel, `${path}.maxParallel`), steps };
+  }
+  #parallelStage(raw, path) {
+    const keys = [
+      "id",
+      "name",
+      "description",
+      "milestone",
+      "when",
+      "timeout",
+      "allowFailure",
+      "parallel",
+      "maxParallel",
+      "failFast",
+      "env",
+      "secrets"
+    ];
+    if (!this.#keys(raw, path, keys))
+      return null;
+    const head = this.#stageHead(raw, path, "workspace");
+    if (!head)
+      return null;
+    const env = this.#env(raw.env, `${path}.env`);
+    const secrets = this.#secrets(raw.secrets, `${path}.secrets`);
+    const ids = new Set;
+    const branches = this.#list(raw.parallel, `${path}.parallel`).flatMap((branch, idx) => {
+      const branchPath = `${path}.parallel[${idx}]`;
+      const branchRaw = this.#object(branch, branchPath);
+      if (!branchRaw)
+        return [];
+      if ("use" in branchRaw || "parallel" in branchRaw || "matrix" in branchRaw) {
+        this.#report("pipeline.schema.invalid", "a parallel branch is a shell stage", branchPath);
+        return [];
+      }
+      const rule = this.#shellStage(branchRaw, branchPath, "workspace");
+      if (!rule)
+        return [];
+      if (rule.when.changed && head.when.changed) {
+        this.#report("pipeline.schema.invalid", "`when.changed` on both a parallel stage and its branch cannot be combined; keep one", `${branchPath}.when.changed`);
+        return [];
+      }
+      this.#claimId(ids, rule.id, rule.path);
+      const steps = rule.steps.map((step) => ({
+        ...step,
+        env: { ...env, ...step.env },
+        secrets: [...new Set([...secrets, ...step.secrets])]
+      }));
+      return [{ ...rule, steps }];
+    });
+    if (!branches.length && Array.isArray(raw.parallel))
+      this.#report("pipeline.schema.invalid", "a parallel stage holds at least one branch", `${path}.parallel`);
+    return {
+      kind: "parallel",
+      ...head,
+      maxParallel: this.#maxParallel(raw.maxParallel, `${path}.maxParallel`),
+      failFast: this.#boolean(raw.failFast, `${path}.failFast`),
+      branches
+    };
+  }
+  #stageHead(raw, path, whenScope) {
+    const name = this.#text(raw.name, `${path}.name`, pipelinePlanLimits.nameChars);
+    if (name === null)
+      return null;
+    const id = raw.id === undefined ? this.#slugId(name, `${path}.name`) : this.#id(raw.id, `${path}.id`);
+    if (!id)
+      return null;
+    return {
+      id,
+      name,
+      description: this.#description(raw.description, `${path}.description`),
+      milestone: this.#milestone(raw.milestone, `${path}.milestone`),
+      when: this.#when(raw.when, `${path}.when`, whenScope === "matrix"),
+      timeoutSeconds: this.#duration(raw.timeout, `${path}.timeout`),
+      allowFailure: this.#boolean(raw.allowFailure, `${path}.allowFailure`),
+      path
+    };
+  }
+  #stageSteps(raw, path) {
+    if (raw.sh === undefined === (raw.steps === undefined)) {
+      this.#report("pipeline.schema.invalid", "takes exactly one of `sh` and `steps`", path);
+      return null;
+    }
+    const env = this.#env(raw.env, `${path}.env`);
+    const secrets = this.#secrets(raw.secrets, `${path}.secrets`);
+    const retry = this.#retry(raw.retry, `${path}.retry`);
+    const steps = raw.sh === undefined ? this.#list(raw.steps, `${path}.steps`) : [raw.sh];
+    const stepsPath = raw.sh === undefined ? `${path}.steps` : path;
+    if (!steps.length) {
+      this.#report("pipeline.schema.invalid", "a stage runs at least one step", stepsPath);
+      return null;
+    }
+    const ids = new Set;
+    return steps.flatMap((step, idx) => {
+      const stepPath = raw.sh === undefined ? `${stepsPath}[${idx}]` : `${path}.sh`;
+      const rule = this.#step(step, stepPath, idx);
+      if (!rule)
+        return [];
+      this.#claimId(ids, rule.localId, stepPath);
+      return [
+        {
+          ...rule,
+          retry: rule.retry ?? retry,
+          env: { ...env, ...rule.env },
+          secrets: [...new Set([...secrets, ...rule.secrets])]
+        }
+      ];
+    });
+  }
+  #step(value, path, idx) {
+    const raw = typeof value === "string" ? { sh: value } : this.#object(value, path);
+    if (!raw)
+      return null;
+    const keys = ["sh", "id", "name", "cwd", "env", "secrets", "timeout", "retry", "allowFailure", "skipExitCodes"];
+    if (!this.#keys(raw, path, keys))
+      return null;
+    const run = this.#text(raw.sh, typeof value === "string" ? path : `${path}.sh`, Number.POSITIVE_INFINITY);
+    if (run === null)
+      return null;
+    if (new TextEncoder().encode(run).length > pipelinePlanLimits.shBytes) {
+      this.#report("pipeline.limit.exceeded", `a script is at most ${pipelinePlanLimits.shBytes} bytes`, path);
+      return null;
+    }
+    const name = raw.name === undefined ? PipelineInputReader.#nameOf(run) : this.#text(raw.name, `${path}.name`, pipelinePlanLimits.nameChars);
+    if (name === null)
+      return null;
+    const localId = raw.id !== undefined ? this.#id(raw.id, `${path}.id`) : raw.name !== undefined ? this.#slugId(name, `${path}.name`) : String(idx + 1);
+    if (!localId)
+      return null;
+    return {
+      localId,
+      name,
+      timeoutSeconds: this.#duration(raw.timeout, `${path}.timeout`),
+      retry: this.#retry(raw.retry, `${path}.retry`),
+      allowFailure: this.#boolean(raw.allowFailure, `${path}.allowFailure`),
+      run,
+      cwd: this.#cwd(raw.cwd, `${path}.cwd`),
+      env: this.#env(raw.env, `${path}.env`),
+      secrets: this.#secrets(raw.secrets, `${path}.secrets`),
+      skipExitCodes: this.#exitCodes(raw.skipExitCodes, `${path}.skipExitCodes`)
+    };
+  }
+  #post(value, path) {
+    const empty = { success: [], failure: [], canceled: [], always: [] };
+    if (value === undefined)
+      return empty;
+    const raw = this.#object(value, path);
+    if (!raw)
+      return empty;
+    for (const key of Object.keys(raw))
+      if (!["success", "failure", "canceled", "always"].includes(key))
+        this.#report("pipeline.schema.unknownKey", key === "unstable" ? "`unstable` is not a result the framework knows: the executor decides which list an allowed failure runs" : `"${key}" is not a post result: success, failure, canceled or always`, `${path}.${key}`);
+    const steps = (key) => {
+      const ids = new Set;
+      return this.#list(raw[key], `${path}.${key}`).flatMap((step, idx) => {
+        const rule = this.#step(step, `${path}.${key}[${idx}]`, idx);
+        if (rule)
+          this.#claimId(ids, rule.localId, `${path}.${key}[${idx}]`);
+        return rule ? [rule] : [];
+      });
+    };
+    return {
+      success: steps("success"),
+      failure: steps("failure"),
+      canceled: steps("canceled"),
+      always: steps("always")
+    };
+  }
+  #when(value, path, allowApp) {
+    const none = { branch: null, trigger: null, changed: null, app: null };
+    if (value === undefined)
+      return none;
+    const raw = this.#object(value, path);
+    if (!raw)
+      return none;
+    for (const key of Object.keys(raw)) {
+      if (["branch", "trigger", "changed"].includes(key) || allowApp && key === "app")
+        continue;
+      this.#report("pipeline.schema.unknownKey", key === "app" ? "`when.app` narrows a workspace matrix stage only; an app's own stages are already that app's" : `"${key}" is not a condition: branch, trigger, changed${allowApp ? " or app" : ""}`, `${path}.${key}`);
+    }
+    const triggers = raw.trigger === undefined ? null : (typeof raw.trigger === "string" ? [raw.trigger] : this.#list(raw.trigger, `${path}.trigger`)).flatMap((trigger, idx) => {
+      const parsed = this.#oneOf(trigger, `${path}.trigger[${idx}]`, pipelineTriggers);
+      return parsed ? [parsed] : [];
+    });
+    return {
+      branch: this.#patterns(raw.branch, `${path}.branch`),
+      trigger: triggers,
+      changed: this.#patterns(raw.changed, `${path}.changed`),
+      app: allowApp ? this.#patterns(raw.app, `${path}.app`) : null
+    };
+  }
+  #patterns(value, path) {
+    if (value === undefined)
+      return null;
+    const patterns = typeof value === "string" ? [value] : this.#strings(value, path);
+    const problem = PipelinePattern.validate(patterns);
+    if (problem) {
+      this.#report("pipeline.when.pattern", problem, path);
+      return null;
+    }
+    return patterns;
+  }
+  #schemaVersion(value, path) {
+    if (value !== undefined && value !== 1)
+      this.#report("pipeline.schema.unsupported", `${JSON.stringify(value)} is not a schemaVersion this CLI reads (1)`, path);
+  }
+  #env(value, path) {
+    if (value === undefined)
+      return {};
+    const raw = this.#object(value, path);
+    if (!raw)
+      return {};
+    const env = {};
+    for (const [name, entry] of Object.entries(raw)) {
+      const problem = PipelineNames.envNameError(name);
+      if (problem)
+        this.#report("pipeline.env.name", problem, `${path}.${name}`);
+      else if (typeof entry !== "string")
+        this.#report("pipeline.schema.invalid", "must be a string", `${path}.${name}`);
+      else
+        env[name] = entry;
+    }
+    return env;
+  }
+  #secrets(value, path) {
+    const names = value === undefined ? [] : this.#strings(value, path);
+    const valid = names.filter((name) => {
+      const problem = PipelineNames.secretNameError(name);
+      if (problem)
+        this.#report("pipeline.secret.name", problem, path);
+      return !problem;
+    });
+    return [...new Set(valid)];
+  }
+  #cwd(value, path) {
+    if (value === undefined)
+      return ".";
+    const cwd = this.#text(value, path, 1024);
+    if (cwd === null)
+      return ".";
+    if (cwd.startsWith("/") || cwd.startsWith("~") || cwd.includes("\\") || cwd.split("/").includes("..")) {
+      this.#report("pipeline.cwd.outside", `"${cwd}" is not a path inside the workspace`, path);
+      return ".";
+    }
+    return cwd;
+  }
+  #exitCodes(value, path) {
+    if (value === undefined)
+      return [];
+    const codes = this.#list(value, path).flatMap((code, idx) => {
+      const parsed = this.#int(code, `${path}[${idx}]`, 1, 255);
+      return parsed === null ? [] : [parsed];
+    });
+    return [...new Set(codes)];
+  }
+  #retry(value, path) {
+    if (value === undefined)
+      return null;
+    if (typeof value === "number") {
+      const attempts = this.#int(value, path, 1, pipelinePlanLimits.retryAttempts);
+      return attempts === null ? null : { attempts, delaySeconds: 0 };
+    }
+    const raw = this.#object(value, path);
+    if (!raw || !this.#keys(raw, path, ["attempts", "delay"]))
+      return null;
+    const attempts = this.#int(raw.attempts, `${path}.attempts`, 1, pipelinePlanLimits.retryAttempts);
+    const delaySeconds = this.#duration(raw.delay, `${path}.delay`, {
+      min: 0,
+      max: pipelinePlanLimits.retryDelaySeconds
+    });
+    return attempts === null ? null : { attempts, delaySeconds: delaySeconds ?? 0 };
+  }
+  #duration(value, path, { min = 1, max = 86400 } = {}) {
+    if (value === undefined)
+      return null;
+    const match = typeof value === "string" ? PipelineInputReader.#durationPattern.exec(value) : null;
+    const seconds = typeof value === "number" && Number.isInteger(value) ? value : match ? Number(match[1]) * { s: 1, m: 60, h: 3600 }[match[2]] : Number.NaN;
+    if (!Number.isInteger(seconds) || seconds < min || seconds > max) {
+      this.#report("pipeline.duration.invalid", `${JSON.stringify(value)} is not a duration between ${min} and ${max} seconds: whole seconds, or "30s", "20m", "1h"`, path);
+      return null;
+    }
+    return seconds;
+  }
+  #maxParallel(value, path) {
+    return value === undefined ? null : this.#int(value, path, 1, pipelinePlanLimits.stages);
+  }
+  #milestone(value, path) {
+    return value === undefined ? null : this.#oneOf(value, path, pipelineMilestones);
+  }
+  #description(value, path) {
+    return value === undefined ? null : this.#text(value, path, pipelinePlanLimits.descriptionChars);
+  }
+  #id(value, path) {
+    const id = this.#text(value, path, 64);
+    if (id === null)
+      return null;
+    const problem = PipelineNames.idError(id);
+    if (problem) {
+      this.#report("pipeline.id.invalid", problem, path);
+      return null;
+    }
+    return id;
+  }
+  #slugId(name, path) {
+    const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+/, "").slice(0, 64).replace(/-+$/, "");
+    if (!slug) {
+      this.#report("pipeline.id.invalid", `"${name}" has no letter or digit to make an id from: give it an \`id\``, path);
+      return null;
+    }
+    return slug;
+  }
+  #claimId(ids, id, path) {
+    if (ids.has(id))
+      this.#report("pipeline.id.duplicate", `"${id}" is already the id of another one here`, path);
+    ids.add(id);
+  }
+  static #nameOf(run) {
+    const line = run.split(`
+`).map((text) => text.trim()).find(Boolean);
+    const name = line ?? run.trim();
+    return name.length > PipelineInputReader.#stepNameChars ? `${name.slice(0, PipelineInputReader.#stepNameChars - 1)}\u2026` : name;
+  }
+  #keys(raw, path, keys) {
+    let ok = true;
+    for (const key of Object.keys(raw)) {
+      if (keys.includes(key))
+        continue;
+      ok = false;
+      if (PipelineInputReader.#futureKeys.includes(key))
+        this.#report("pipeline.schema.unsupported", `\`${key}\` is not supported in schemaVersion 1`, `${path}.${key}`);
+      else
+        this.#report("pipeline.schema.unknownKey", `"${key}" is not a key here: ${keys.join(", ")}`, `${path}.${key}`);
+    }
+    return ok;
+  }
+  #object(value, path, keys) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+      this.#report("pipeline.schema.invalid", "must be an object", path);
+      return null;
+    }
+    const raw = value;
+    if (keys && !this.#keys(raw, path, keys))
+      return null;
+    return raw;
+  }
+  #list(value, path) {
+    if (value === undefined)
+      return [];
+    if (!Array.isArray(value)) {
+      this.#report("pipeline.schema.invalid", "must be a list", path);
+      return [];
+    }
+    return value;
+  }
+  #strings(value, path) {
+    return this.#list(value, path).flatMap((item, idx) => {
+      const text = this.#text(item, `${path}[${idx}]`, 1024);
+      return text === null ? [] : [text];
+    });
+  }
+  #text(value, path, max) {
+    if (typeof value !== "string" || !value.trim()) {
+      this.#report("pipeline.schema.invalid", "must be a non-empty string", path);
+      return null;
+    }
+    if (value.length > max) {
+      this.#report("pipeline.schema.invalid", `is longer than ${max} characters`, path);
+      return null;
+    }
+    return value;
+  }
+  #boolean(value, path) {
+    if (value === undefined)
+      return false;
+    if (typeof value === "boolean")
+      return value;
+    this.#report("pipeline.schema.invalid", "must be true or false", path);
+    return false;
+  }
+  #int(value, path, min, max) {
+    if (typeof value === "number" && Number.isInteger(value) && value >= min && value <= max)
+      return value;
+    this.#report("pipeline.schema.invalid", `must be a whole number between ${min} and ${max}`, path);
+    return null;
+  }
+  #oneOf(value, path, options) {
+    if (typeof value === "string" && options.includes(value))
+      return value;
+    this.#report("pipeline.schema.invalid", `${JSON.stringify(value)} is not one of ${options.join(", ")}`, path);
+    return null;
+  }
+  #report(code, message, path) {
+    this.diagnostics.push({ severity: "error", code, message, file: this.#file, path });
+  }
+}
+
+// pkgs/@akanjs/devkit/pipeline/PipelineCompiler.ts
+class PipelineCompiler {
+  static #slotAfter = {
+    build: "after-build",
+    docker: "after-docker",
+    deploy: "after-deploy",
+    ota: "after-ota"
+  };
+  static #slotMilestones = {
+    "before-build": "prepare",
+    "after-build": "verify",
+    "after-docker": "package",
+    "after-deploy": "deploy",
+    "after-ota": "deploy"
+  };
+  static #slotNames = {
+    "before-build": "Before build",
+    "after-build": "After build",
+    "after-docker": "After docker",
+    "after-deploy": "After deploy",
+    "after-ota": "After OTA"
+  };
+  static #reservedPhaseId = /^(?:build|docker|deploy|ota|(?:before-build|after-build|after-docker|after-deploy|after-ota)(?:-\d+)?)$/;
+  static #actionStepNames = { build: "akan build", docker: "image", deploy: "deploy", ota: "ota" };
+  static compile(input) {
+    return new PipelineCompiler(input).#compile();
+  }
+  #input;
+  #diagnostics;
+  #secrets = new Set;
+  constructor(input) {
+    this.#input = input;
+    this.#diagnostics = [...input.diagnostics ?? []];
+  }
+  #compile() {
+    const { context, workspaceApps } = this.#input;
+    this.#checkContext();
+    const pipelineContext = {
+      branch: context.branch,
+      env: context.env,
+      apps: [...context.apps],
+      workspaceApps: [...workspaceApps],
+      trigger: context.trigger,
+      buildNum: context.buildNum,
+      commit: context.commit
+    };
+    const workspace = this.#readWorkspace(pipelineContext);
+    const lanes = new Map;
+    for (const app of new Set(context.apps)) {
+      const lane = this.#readApp(app, pipelineContext);
+      if (lane)
+        lanes.set(app, lane);
+    }
+    const appOrder = this.#appOrder(lanes);
+    if (this.#hasErrors())
+      return this.#failed();
+    const workspaceEnv = workspace?.env ?? {};
+    const phases = this.#phases(workspace, lanes, appOrder, workspaceEnv);
+    const post = this.#post(workspace?.post, workspaceEnv);
+    if (this.#hasErrors())
+      return this.#failed();
+    const plan = {
+      schemaVersion: pipelinePlanVersion,
+      sources: this.#sources(),
+      planner: { akanVersion: this.#input.akanVersion },
+      context: { ...context, apps: [...context.apps] },
+      appOrder,
+      timeoutSeconds: workspace?.timeoutSeconds ?? null,
+      requiredSecrets: [...this.#secrets].sort(),
+      phases,
+      post
+    };
+    try {
+      PipelinePlanSchema.parse(plan);
+    } catch (error) {
+      const message = error instanceof Error ? error.message : String(error);
+      this.#error(message.includes("at most") ? "pipeline.limit.exceeded" : "pipeline.internal", message, null, null);
+      return this.#failed();
+    }
+    return { ok: true, plan, diagnostics: this.#diagnostics };
+  }
+  #checkContext() {
+    const { context, workspaceApps } = this.#input;
+    const seen = new Set;
+    for (const app of context.apps) {
+      if (seen.has(app))
+        this.#error("pipeline.context.duplicateApp", `"${app}" is given twice`, null, "apps");
+      seen.add(app);
+      if (!workspaceApps.includes(app))
+        this.#error("pipeline.context.unknownApp", `"${app}" is not an app of this workspace`, null, "apps");
+    }
+  }
+  #readWorkspace(context) {
+    const source = this.#input.workspace;
+    if (!source?.pipeline)
+      return null;
+    const value = this.#evaluate(source.pipeline, context, source.file);
+    if (value === undefined)
+      return null;
+    const reader = new PipelineInputReader(source.file);
+    const rule = reader.workspace(value);
+    this.#diagnostics.push(...reader.diagnostics);
+    return rule;
+  }
+  #readApp(app, context) {
+    const source = this.#input.apps.get(app);
+    if (!source)
+      return null;
+    const appContext = { ...context, app };
+    const value = source.pipeline ? this.#evaluate(source.pipeline, appContext, source.file) : defaultAppPipeline;
+    if (value === undefined)
+      return null;
+    const reader = new PipelineInputReader(source.file);
+    const rule = reader.app(value);
+    this.#diagnostics.push(...reader.diagnostics);
+    return rule ? this.#lane(app, rule, source.file) : null;
+  }
+  #evaluate(config, context, file) {
+    if (typeof config !== "function")
+      return config;
+    if (this.#input.sampled)
+      this.#warning("pipeline.function.sampled", "a function form was checked against one sample context; other branches, triggers or apps may differ", file, "pipeline");
+    try {
+      return config(context);
+    } catch (error) {
+      this.#error("pipeline.load.failed", `the pipeline function threw: ${error instanceof Error ? error.message : String(error)}`, file, "pipeline");
+      return;
+    }
+  }
+  #lane(app, rule, file) {
+    const lane = {
+      file,
+      env: rule.env,
+      after: rule.after,
+      actions: new Map,
+      skips: new Map,
+      slots: { "before-build": [], "after-build": [], "after-docker": [], "after-deploy": [], "after-ota": [] },
+      ota: null
+    };
+    let last = null;
+    let lastMilestone = -1;
+    for (const stage of rule.stages) {
+      const milestone = stage.milestone ?? (stage.kind === "action" ? pipelineActions[stage.action].milestone : PipelineCompiler.#slotMilestones[last ? PipelineCompiler.#slotAfter[last] : "before-build"]);
+      const rank = pipelineMilestones2.indexOf(milestone);
+      if (stage.milestone && rank < lastMilestone)
+        this.#warning("pipeline.milestone.backwards", `"${milestone}" comes after a later milestone, so progress would move backwards`, file, `${stage.path}.milestone`);
+      lastMilestone = Math.max(lastMilestone, rank);
+      if (stage.kind === "sh") {
+        lane.slots[last ? PipelineCompiler.#slotAfter[last] : "before-build"].push(stage);
+        continue;
+      }
+      if (lane.actions.has(stage.action)) {
+        this.#error("pipeline.action.duplicate", `\`${stage.action}\` is declared twice`, file, stage.path);
+        continue;
+      }
+      if (last && pipelineActionNames2.indexOf(stage.action) < pipelineActionNames2.indexOf(last))
+        this.#error("pipeline.action.order", `\`${stage.action}\` comes after \`${last}\` here, but the actions run ${pipelineActionNames2.join(", ")}`, file, stage.path);
+      lane.actions.set(stage.action, stage);
+      last = stage.action;
+    }
+    const docker = lane.actions.get("docker");
+    if (docker && !lane.actions.has("build"))
+      this.#error("pipeline.action.dockerWithoutBuild", `\`docker\` builds the image from this run's \`akan build\` of ${app}, so it needs a \`build\` before it`, file, docker.path);
+    const deploy = lane.actions.get("deploy");
+    if (deploy && !lane.actions.has("docker"))
+      this.#warning("pipeline.action.deployWithoutDocker", `\`deploy\` without \`docker\` deploys the image last pushed for ${app}`, file, deploy.path);
+    const ota = lane.actions.get("ota");
+    if (ota)
+      lane.ota = this.#otaTargets(app, ota, file);
+    if (!lane.actions.size)
+      this.#warning("pipeline.app.noActions", `the pipeline of ${app} takes no built-in action, so this run neither builds nor deploys it`, file, "pipeline.stages");
+    let previous = null;
+    for (const action of pipelineActionNames2) {
+      const stage = lane.actions.get(action);
+      if (!stage)
+        continue;
+      const inherited = previous && lane.skips.get(previous) ? { reason: `${previous} of ${app} is skipped` } : null;
+      lane.skips.set(action, this.#skipOf(stage.when) ?? inherited);
+      previous = action;
+    }
+    return lane;
+  }
+  #otaTargets(app, stage, file) {
+    const platforms = stage.platforms ?? [...pipelineOtaPlatforms2];
+    const native = this.#input.nativeTargets?.get(app);
+    if (!native || "error" in native) {
+      this.#error("pipeline.ota.targets", `\`ota\` needs the native targets of ${app}, which could not be read${native ? `: ${native.error}` : ""}`, file, stage.path);
+      return null;
+    }
+    const known = new Map(native.targets.map((target) => [target.name, target.updates]));
+    if (!stage.targets) {
+      const targets = native.targets.filter((target) => target.updates).map((target) => target.name);
+      if (targets.length)
+        return { targets, platforms };
+      this.#error("pipeline.ota.noUpdates", `\`ota\` packs updates for targets that declare native.updates, and no native target of ${app} does`, file, stage.path);
+      return null;
+    }
+    const unknown = stage.targets.filter((name) => !known.has(name));
+    const withoutUpdates = stage.targets.filter((name) => known.get(name) === false);
+    if (unknown.length)
+      this.#error("pipeline.ota.unknownTarget", `${unknown.map((name) => `"${name}"`).join(", ")} ${unknown.length > 1 ? "are not native targets" : "is not a native target"} of ${app}: ${[...known.keys()].join(", ")}`, file, `${stage.path}.targets`);
+    if (withoutUpdates.length)
+      this.#error("pipeline.ota.noUpdates", `\`ota\` packs updates for targets that declare native.updates, and ${withoutUpdates.map((name) => `"${name}"`).join(", ")} of ${app} ${withoutUpdates.length > 1 ? "do" : "does"} not`, file, `${stage.path}.targets`);
+    return unknown.length || withoutUpdates.length ? null : { targets: stage.targets, platforms };
+  }
+  #appOrder(lanes) {
+    const apps = [...new Set(this.#input.context.apps)];
+    const known = new Set(apps);
+    const after = new Map(apps.map((app) => [app, new Set((lanes.get(app)?.after ?? []).filter((dep) => known.has(dep) && dep !== app))]));
+    const order = [];
+    const done = new Set;
+    while (order.length < apps.length) {
+      const next = apps.find((app) => !done.has(app) && [...after.get(app) ?? []].every((dep) => done.has(dep)));
+      if (!next) {
+        const waiting = apps.filter((app) => !done.has(app));
+        this.#error("pipeline.app.afterCycle", `\`after\` makes a cycle among ${waiting.join(", ")}`, lanes.get(waiting[0] ?? "")?.file ?? null, "pipeline.after");
+        return apps;
+      }
+      order.push(next);
+      done.add(next);
+    }
+    return order;
+  }
+  #phases(workspace, lanes, appOrder, workspaceEnv) {
+    const phases = [];
+    for (const stage of workspace?.before ?? [])
+      phases.push(...this.#workspacePhase(stage, "before", appOrder, workspaceEnv));
+    phases.push(...this.#customPhases("before-build", lanes, appOrder, workspaceEnv));
+    for (const action of pipelineActionNames2) {
+      const phase = this.#actionPhase(action, lanes, appOrder);
+      if (phase)
+        phases.push(phase);
+      phases.push(...this.#customPhases(PipelineCompiler.#slotAfter[action], lanes, appOrder, workspaceEnv));
+    }
+    for (const stage of workspace?.after ?? [])
+      phases.push(...this.#workspacePhase(stage, "after", appOrder, workspaceEnv));
+    return phases;
+  }
+  #actionPhase(action, lanes, appOrder) {
+    const stages = appOrder.flatMap((app) => {
+      const lane = lanes.get(app);
+      const rule = lane?.actions.get(action);
+      if (!lane || !rule)
+        return [];
+      const id = `${app}:${rule.id}`;
+      return [
+        {
+          id,
+          name: rule.named ? rule.name : app,
+          description: rule.description,
+          app,
+          milestone: rule.milestone ?? pipelineActions[action].milestone,
+          skip: lane.skips.get(action) ?? null,
+          runtimeWhen: rule.when.changed ? { changed: rule.when.changed } : null,
+          allowFailure: rule.allowFailure,
+          timeoutSeconds: rule.timeoutSeconds,
+          steps: [
+            {
+              id: `${id}/${action}`,
+              name: `${PipelineCompiler.#actionStepNames[action]} ${app}`,
+              timeoutSeconds: null,
+              retry: rule.retry,
+              allowFailure: false,
+              kind: "action",
+              actionVersion: pipelineActions[action].version,
+              ...action === "ota" ? { action, with: { app, targets: lane.ota?.targets ?? [], platforms: lane.ota?.platforms ?? [] } } : { action, with: { app } }
+            }
+          ]
+        }
+      ];
+    });
+    if (!stages.length)
+      return null;
+    return {
+      id: action,
+      name: pipelineActions[action].name,
+      description: null,
+      slot: action,
+      milestone: pipelineActions[action].milestone,
+      action,
+      order: action === "deploy" ? "sequential" : "parallel",
+      maxParallel: null,
+      failFast: false,
+      timeoutSeconds: null,
+      stages
+    };
+  }
+  #customPhases(slot, lanes, appOrder, workspaceEnv) {
+    const depth = Math.max(0, ...appOrder.map((app) => lanes.get(app)?.slots[slot].length ?? 0));
+    const milestone = PipelineCompiler.#slotMilestones[slot];
+    return Array.from({ length: depth }, (_, idx) => {
+      const stages = appOrder.flatMap((app) => {
+        const lane = lanes.get(app);
+        const rule = lane?.slots[slot][idx];
+        if (!lane || !rule)
+          return [];
+        return [
+          this.#shellStage(rule, {
+            id: `${app}:${rule.id}`,
+            app,
+            milestone: rule.milestone ?? milestone,
+            env: { ...workspaceEnv, ...lane.env }
+          })
+        ];
+      });
+      return {
+        id: idx === 0 ? slot : `${slot}-${idx + 1}`,
+        name: idx === 0 ? PipelineCompiler.#slotNames[slot] : `${PipelineCompiler.#slotNames[slot]} ${idx + 1}`,
+        description: null,
+        slot,
+        milestone,
+        action: null,
+        order: "parallel",
+        maxParallel: null,
+        failFast: false,
+        timeoutSeconds: null,
+        stages
+      };
+    });
+  }
+  #workspacePhase(stage, position, appOrder, env) {
+    if (PipelineCompiler.#reservedPhaseId.test(stage.id))
+      this.#error("pipeline.id.reserved", `"${stage.id}" is the id of a phase the planner makes; give this stage another \`id\``, this.#input.workspace?.file ?? null, stage.path);
+    const milestone = stage.milestone ?? (position === "before" ? "prepare" : "finish");
+    const phase = {
+      id: stage.id,
+      name: stage.name,
+      description: stage.description,
+      slot: position,
+      milestone,
+      action: null,
+      order: "parallel"
+    };
+    if (stage.kind === "sh")
+      return [
+        {
+          ...phase,
+          maxParallel: null,
+          failFast: false,
+          timeoutSeconds: null,
+          stages: [this.#shellStage(stage, { id: stage.id, milestone, env })]
+        }
+      ];
+    const parentSkip = this.#skipOf(stage.when);
+    if (stage.kind === "parallel")
+      return [
+        {
+          ...phase,
+          maxParallel: stage.maxParallel,
+          failFast: stage.failFast,
+          timeoutSeconds: stage.timeoutSeconds,
+          stages: stage.branches.map((branch) => this.#shellStage(branch, {
+            id: `${stage.id}.${branch.id}`,
+            milestone: branch.milestone ?? milestone,
+            env,
+            inheritedSkip: parentSkip,
+            allowFailure: stage.allowFailure,
+            changed: stage.when.changed
+          }))
+        }
+      ];
+    const apps = appOrder.filter((app) => !stage.when.app || PipelinePattern2.matches(stage.when.app, app));
+    if (!apps.length)
+      return [];
+    const copy = { ...stage, kind: "sh", timeoutSeconds: null };
+    return [
+      {
+        ...phase,
+        maxParallel: stage.maxParallel,
+        failFast: false,
+        timeoutSeconds: stage.timeoutSeconds,
+        stages: apps.map((app) => this.#shellStage(copy, { id: `${stage.id}:${app}`, name: app, app, milestone, env }))
+      }
+    ];
+  }
+  #shellStage(rule, options) {
+    const changed = options.changed ?? rule.when.changed;
+    return {
+      id: options.id,
+      name: options.name ?? rule.name,
+      description: rule.description,
+      app: options.app ?? null,
+      milestone: options.milestone,
+      skip: options.inheritedSkip ?? this.#skipOf(rule.when),
+      runtimeWhen: changed ? { changed } : null,
+      allowFailure: (options.allowFailure ?? false) || rule.allowFailure,
+      timeoutSeconds: options.timeoutSeconds === undefined ? rule.timeoutSeconds : options.timeoutSeconds,
+      steps: rule.steps.map((step) => this.#shellStep(step, options.id, options.env))
+    };
+  }
+  #shellStep(step, stageId, env) {
+    for (const name of step.secrets)
+      this.#secrets.add(name);
+    return {
+      id: `${stageId}/${step.localId}`,
+      name: step.name,
+      timeoutSeconds: step.timeoutSeconds,
+      retry: step.retry,
+      allowFailure: step.allowFailure,
+      kind: "sh",
+      run: step.run,
+      cwd: step.cwd,
+      env: { ...env, ...step.env },
+      secrets: step.secrets,
+      skipExitCodes: step.skipExitCodes
+    };
+  }
+  #post(rule, env) {
+    const steps = (result) => (rule?.[result] ?? []).map((step) => this.#shellStep(step, `post.${result}`, env));
+    return {
+      success: steps("success"),
+      failure: steps("failure"),
+      canceled: steps("canceled"),
+      always: steps("always")
+    };
+  }
+  #skipOf(when) {
+    const { branch, trigger } = this.#input.context;
+    if (when.branch && !PipelinePattern2.matches(when.branch, branch))
+      return { reason: `branch "${branch}" does not match ${when.branch.map((glob) => `"${glob}"`).join(", ")}` };
+    if (when.trigger && !when.trigger.includes(trigger))
+      return { reason: `trigger "${trigger}" is not ${when.trigger.map((name) => `"${name}"`).join(" or ")}` };
+    return null;
+  }
+  #sources() {
+    const { workspace, apps, context } = this.#input;
+    const sourceOf = (source) => ({
+      file: source.file,
+      sha256: source.sha256,
+      declared: source.pipeline !== null
+    });
+    return {
+      workspace: workspace ? sourceOf(workspace) : null,
+      apps: Object.fromEntries(context.apps.flatMap((app) => {
+        const source = apps.get(app);
+        return source ? [[app, sourceOf(source)]] : [];
+      }))
+    };
+  }
+  #hasErrors() {
+    return this.#diagnostics.some((diagnostic) => diagnostic.severity === "error");
+  }
+  #failed() {
+    return { ok: false, plan: null, diagnostics: this.#diagnostics };
+  }
+  #error(code, message, file, path) {
+    this.#diagnostics.push({ severity: "error", code, message, file, path });
+  }
+  #warning(code, message, file, path) {
+    this.#diagnostics.push({ severity: "warning", code, message, file, path });
+  }
+}
+// pkgs/@akanjs/devkit/pipeline/PipelineDefinition.ts
+import { readFile } from "fs/promises";
+import path from "path";
+class PipelineDefinition {
+  static async load(workspace, apps) {
+    const definition = new PipelineDefinition(workspace);
+    await definition.#load(apps);
+    return definition;
+  }
+  diagnostics = [];
+  appSources = new Map;
+  nativeTargets = new Map;
+  workspaceApps = [];
+  workspaceSource = null;
+  #workspace;
+  constructor(workspace) {
+    this.#workspace = workspace;
+  }
+  compile(context, { sampled = false } = {}) {
+    return PipelineCompiler.compile({
+      context,
+      workspaceApps: this.workspaceApps,
+      workspace: this.workspaceSource,
+      apps: this.appSources,
+      nativeTargets: this.nativeTargets,
+      akanVersion: AkanAppConfig.akanVersion,
+      sampled,
+      diagnostics: this.diagnostics
+    });
+  }
+  async#load(apps) {
+    this.workspaceApps = (await this.#workspace.getApps()).sort((a, b) => a.localeCompare(b));
+    this.workspaceSource = await this.#loadWorkspace();
+    for (const app of new Set(apps)) {
+      if (!this.workspaceApps.includes(app))
+        continue;
+      const source = await this.#loadApp(app);
+      this.appSources.set(app, source);
+      if (PipelineDefinition.#mayTakeOta(source.pipeline))
+        this.nativeTargets.set(app, await this.#loadNativeTargets(app));
+    }
+  }
+  static #mayTakeOta(pipeline) {
+    if (typeof pipeline === "function")
+      return true;
+    const stages = pipeline?.stages;
+    return Array.isArray(stages) && stages.some((stage) => stage?.use === "ota");
+  }
+  async#loadNativeTargets(app) {
+    try {
+      const targets = await resolveMobileTargets(AppExecutor.from(this.#workspace, app), "all");
+      return { targets: targets.map(({ name, config }) => ({ name, updates: !!config.updates })) };
+    } catch (error) {
+      return { error: error instanceof Error ? error.message : String(error) };
+    }
+  }
+  async#loadWorkspace() {
+    const file = AkanWorkspaceConfig.fileName;
+    const absolute = path.join(this.#workspace.workspaceRoot, file);
+    if (!await FileSys2.fileExists(absolute))
+      return null;
+    const sha256 = await PipelineDefinition.#sha256(absolute);
+    try {
+      return { file, sha256, pipeline: (await this.#workspace.getConfig()).pipeline };
+    } catch (error) {
+      this.#failed(file, error);
+      return { file, sha256, pipeline: null };
+    }
+  }
+  async#loadApp(app) {
+    const executor = AppExecutor.from(this.#workspace, app);
+    const file = `apps/${app}/akan.config.ts`;
+    const sha256 = await PipelineDefinition.#sha256(path.join(executor.cwdPath, "akan.config.ts"));
+    try {
+      const module = await AkanAppConfig.importConfigModule(executor.cwdPath);
+      const config = typeof module === "function" ? module(executor) : module;
+      const pipeline = typeof config === "object" && config !== null ? config.pipeline : null;
+      return { file, sha256, pipeline: pipeline ?? null };
+    } catch (error) {
+      this.#failed(file, error);
+      return { file, sha256, pipeline: null };
+    }
+  }
+  #failed(file, error) {
+    this.diagnostics.push({
+      severity: "error",
+      code: "pipeline.load.failed",
+      message: `could not load: ${error instanceof Error ? error.message : String(error)}`,
+      file,
+      path: null
+    });
+  }
+  static async#sha256(file) {
+    return new Bun.CryptoHasher("sha256").update(await readFile(file)).digest("hex");
+  }
+}
+// pkgs/@akanjs/devkit/pipeline/PipelineDryRun.ts
+class PipelineDryRun {
+  static render(result) {
+    const lines = result.ok ? PipelineDryRun.#plan(result.plan) : ["no plan: the definition has errors"];
+    const diagnostics = PipelineDryRun.diagnostics(result.diagnostics);
+    return [...lines, ...diagnostics.length ? ["", ...diagnostics] : []].join(`
+`);
+  }
+  static #plan(plan) {
+    const { context } = plan;
+    const order = plan.appOrder.join() === context.apps.join() ? "" : ` \xB7 order ${plan.appOrder.join(" \u2192 ")}`;
+    const rows = [
+      ["prepare", "(executor)", "", "checkout \xB7 env \xB7 install \xB7 plan"],
+      ...plan.phases.map((phase) => [
+        phase.milestone,
+        phase.id,
+        phase.name,
+        PipelineDryRun.#stages(phase)
+      ]),
+      ...["success", "failure", "canceled", "always"].flatMap((result) => {
+        const steps = plan.post[result];
+        if (!steps.length)
+          return [];
+        return [["finish", `post.${result}`, "", steps.map((step) => step.name).join(" \xB7 ")]];
+      }),
+      ["finish", "(executor)", "", "cleanup"]
+    ];
+    const widths = [0, 1, 2].map((column) => Math.max(...rows.map((row) => row[column]?.length ?? 0)));
+    const sources = [
+      ...plan.sources.workspace ? [plan.sources.workspace] : [],
+      ...Object.values(plan.sources.apps)
+    ].map((source) => `${source.file}${source.declared ? "" : " (default)"}`);
+    return [
+      `plan v${plan.schemaVersion} \xB7 branch ${context.branch} \xB7 env ${context.env} \xB7 trigger ${context.trigger} \xB7 apps ${context.apps.join(", ") || "(none)"}${order}`,
+      `from ${sources.join(", ") || "(no files)"}`,
+      "",
+      ...rows.map((row) => row.map((cell, column) => column < 3 ? cell.padEnd(widths[column] ?? 0) : cell).join("  ").trimEnd()),
+      ...plan.requiredSecrets.length ? ["", `secrets required: ${plan.requiredSecrets.join(", ")}`] : []
+    ];
+  }
+  static #stages(phase) {
+    const labels = phase.stages.map((stage) => PipelineDryRun.#stage(phase, stage));
+    if (phase.order === "sequential")
+      return `\u2192 ${labels.join(", ")} (one at a time)`;
+    if (phase.stages.length === 1) {
+      const [stage] = phase.stages;
+      const command = stage?.steps.map((step) => step.kind === "sh" ? step.name : `action ${step.action}`).join(" \xB7 ");
+      return [labels[0], command].filter((part) => part && part !== stage?.name).join("  ");
+    }
+    return `\u2016 ${labels.join(" \xB7 ")}`;
+  }
+  static #stage(phase, stage) {
+    const label = stage.app && !phase.action && stage.name !== stage.app ? `${stage.app}:${stage.name}` : stage.name;
+    const ota = stage.steps.find((step) => step.kind === "action" && step.action === "ota");
+    const notes = [
+      ota?.kind === "action" && ota.action === "ota" ? `${ota.with.targets.join(", ")} \xD7 ${ota.with.platforms.join(", ")}` : null,
+      stage.skip ? `skipped: ${stage.skip.reason}` : null,
+      stage.allowFailure ? "may fail" : null,
+      stage.runtimeWhen ? `if changed: ${stage.runtimeWhen.changed.join(", ")}` : null
+    ].filter(Boolean);
+    return notes.length ? `${label} (${notes.join("; ")})` : label;
+  }
+  static diagnostics(diagnostics) {
+    return diagnostics.map((diagnostic) => {
+      const where = [diagnostic.file, diagnostic.path].filter(Boolean).join(" \xB7 ");
+      return `${diagnostic.severity} ${diagnostic.code}${where ? ` (${where})` : ""}: ${diagnostic.message}`;
+    });
+  }
+}
+// pkgs/@akanjs/cli/pipeline/pipeline.script.ts
+import { Logger } from "akanjs/common";
+
+// pkgs/@akanjs/cli/pipeline/pipeline.runner.ts
+import { mkdir, open, rename } from "fs/promises";
+import path2 from "path";
+class PipelineRunner extends runner("pipeline") {
+  async context(workspace, flags) {
+    if (!Number.isInteger(flags.buildNum) || flags.buildNum < 0)
+      throw new Error(`--build-num ${flags.buildNum} is not a whole number of 0 or more`);
+    const branch = flags.branch ?? await PipelineRunner.#git(workspace, ["rev-parse", "--abbrev-ref", "HEAD"]) ?? "main";
+    return {
+      branch,
+      env: flags.env ?? branch,
+      apps: flags.apps === null ? (await workspace.getApps()).sort((a, b) => a.localeCompare(b)) : flags.apps.split(","),
+      trigger: flags.trigger,
+      buildNum: flags.buildNum,
+      commit: flags.commit ?? await PipelineRunner.#git(workspace, ["rev-parse", "HEAD"])
+    };
+  }
+  async plan(workspace, context, { sampled = false } = {}) {
+    return (await PipelineDefinition.load(workspace, context.apps)).compile(context, { sampled });
+  }
+  async writeResult(out, result) {
+    const target = path2.resolve(out);
+    await mkdir(path2.dirname(target), { recursive: true });
+    const temp = `${target}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    const handle = await open(temp, "wx");
+    try {
+      await handle.writeFile(`${JSON.stringify(result, null, 2)}
+`);
+    } finally {
+      await handle.close();
+    }
+    await rename(temp, target);
+  }
+  static async#git(workspace, args) {
+    try {
+      const output = (await workspace.spawn("git", args)).trim();
+      return output && output !== "HEAD" ? output : null;
+    } catch {
+      return null;
+    }
+  }
+}
+
+// pkgs/@akanjs/cli/pipeline/pipeline.script.ts
+class PipelineScript extends script("pipeline", [PipelineRunner]) {
+  async run(workspace, action, { flags, out, format }) {
+    let result;
+    try {
+      const context = await this.pipelineRunner.context(workspace, flags);
+      result = await this.pipelineRunner.plan(workspace, context, { sampled: action === "validate" });
+      if (out)
+        await this.pipelineRunner.writeResult(out, result);
+    } catch (error) {
+      Logger.rawLog(`akan pipeline ${action}: ${error instanceof Error ? error.message : String(error)}`, undefined, "error");
+      process.exitCode = 2;
+      return;
+    }
+    if (format === "json" || action === "plan" && !out)
+      process.stdout.write(`${JSON.stringify(result, null, 2)}
+`);
+    else
+      Logger.rawLog(action === "dry-run" ? PipelineDryRun.render(result) : PipelineScript.#summary(action, result, out));
+    if (!result.ok)
+      process.exitCode = 1;
+  }
+  static #summary(action, result, out) {
+    const head = result.ok ? `${action === "plan" ? "planned" : "valid"}: ${result.plan.phases.length} phases, ${result.plan.phases.reduce((sum, phase) => sum + phase.stages.length, 0)} stages` : `${action === "plan" ? "no plan" : "invalid"}: ${result.diagnostics.filter((diagnostic) => diagnostic.severity === "error").length} error(s)`;
+    return [`${head}${out ? ` \u2192 ${out}` : ""}`, ...PipelineDryRun.diagnostics(result.diagnostics)].join(`
+`);
+  }
+}
+
+// pkgs/@akanjs/cli/pipeline/pipeline.command.ts
+class PipelineCommand extends command("pipeline", [PipelineScript], ({ public: target }) => ({
+  pipeline: target({
+    desc: "Plan the build pipeline declared in akan.config.ts (the workspace root's and each app's) without running it",
+    failureExitCode: 2
+  }).arg("action", String, {
+    desc: "plan: the JSON plan an executor runs \xB7 validate: check the definitions \xB7 dry-run: show the plan",
+    default: "dry-run",
+    enum: ["plan", "validate", "dry-run"]
+  }).option("branch", String, { desc: "the branch the run builds (default: the current git branch)", nullable: true }).option("env", String, { desc: "the AKAN_PUBLIC_ENV the run is for (default: the branch)", nullable: true }).option("apps", String, { desc: "the apps the run builds, comma-separated (default: every app)", nullable: true }).option("trigger", String, { desc: "what started the run", default: "manual", enum: [...pipelineTriggers2] }).option("buildNum", Number, { flag: "n", desc: "the run's build number", default: 0 }).option("commit", String, { desc: "the commit the run builds (default: HEAD)", nullable: true }).option("out", String, {
+    desc: "also write the result envelope, { ok, plan, diagnostics }, to this file",
+    nullable: true
+  }).option("format", String, { desc: "output format", default: "text", enum: ["text", "json"] }).with(Workspace).exec(async function(action, branch, env, apps, trigger, buildNum, commit, out, format, workspace) {
+    await this.pipelineScript.run(workspace, action, {
+      flags: { branch, env, apps, trigger, buildNum, commit },
+      out,
+      format
+    });
+  })
+})) {
+}
+export {
+  PipelineCommand
+};