@akanjs/cli 3.1.0-rc.0 → 3.1.0-rc.10

package/index-cpb3nvma.js

@@ -0,0 +1,667 @@
+// @bun
+import {
+  FileSys2
+} from "./index-52w0fvh8.js";
+import {
+  resolveMobileTargets
+} from "./index-m9jj544v.js";
+import {
+  NativePublicEnv,
+  UpdatePackFolder,
+  NativeApp
+} from "./index-g1mbppa9.js";
+import {
+  ExitCodeError
+} from "./index-jw1zm273.js";
+import {
+  ConfigLock
+} from "./index-bqbf654f.js";
+
+// pkgs/@akanjs/devkit/cloud/cloudHttpError.ts
+import { isRecord } from "akanjs/common";
+
+class CloudHttpError extends Error {
+  status;
+  statusText;
+  url;
+  body;
+  headers;
+  static #errKey = /^[\w$-]+\.error\.[\w$-]+$/;
+  name = "CloudHttpError";
+  constructor(status, statusText, url, body, headers = new Headers) {
+    super(`${status} ${statusText} from ${url}: ${body.slice(0, 200)}`);
+    this.status = status;
+    this.statusText = statusText;
+    this.url = url;
+    this.body = body;
+    this.headers = headers;
+  }
+  static async of(response, url) {
+    return new CloudHttpError(response.status, response.statusText, url, await response.text(), response.headers);
+  }
+  static statusOf(error) {
+    return error instanceof CloudHttpError ? error.status : null;
+  }
+  get error() {
+    try {
+      const parsed = JSON.parse(this.body);
+      return isRecord(parsed) && typeof parsed.error === "string" ? parsed.error : null;
+    } catch {
+      return null;
+    }
+  }
+  get errKey() {
+    const { error } = this;
+    return error && CloudHttpError.#errKey.test(error) ? error : null;
+  }
+  get retryAfterMs() {
+    return CloudHttpError.retryAfterMs(this.headers.get("retry-after"));
+  }
+  static retryAfterMs(header) {
+    const value = header?.trim() ?? "";
+    if (!value)
+      return null;
+    const ms = /^\d+$/.test(value) ? Number(value) * 1000 : Date.parse(value) - Date.now();
+    return Number.isFinite(ms) ? Math.max(0, ms) : null;
+  }
+}
+
+// pkgs/@akanjs/devkit/cloud/globalConfig.ts
+import { mkdir, rm, writeFile } from "fs/promises";
+import { trimTrailingSlashes } from "akanjs/common";
+import dayjs from "dayjs";
+
+// pkgs/@akanjs/devkit/cloud/constants.ts
+import path from "path";
+var basePath = path.join(Bun.env.HOME ?? Bun.env.USERPROFILE ?? "", ".akan");
+var configPath = path.join(basePath, "config.json");
+var getDefaultHostConfig = (host = GlobalConfig.akanCloudHost) => ({ host });
+var defaultAkanGlobalConfig = {
+  cloudHost: {},
+  remoteEnvServers: {},
+  testTargets: {}
+};
+
+// pkgs/@akanjs/devkit/cloud/globalConfig.ts
+class GlobalConfig {
+  static akanCloudHost = process.env.USE_AKANJS_PKGS === "true" ? `http://localhost:${process.env.CLOUD_HOST_PORT ?? 8283}` : "https://cloud.akanjs.com";
+  static async#getAkanGlobalConfig() {
+    const exists = await FileSys2.fileExists(configPath);
+    const akanConfig = exists ? await FileSys2.readJson(configPath) : {};
+    return {
+      ...defaultAkanGlobalConfig,
+      ...akanConfig,
+      cloudHost: akanConfig.cloudHost ?? defaultAkanGlobalConfig.cloudHost,
+      remoteEnvServers: akanConfig.remoteEnvServers ?? defaultAkanGlobalConfig.remoteEnvServers,
+      testTargets: akanConfig.testTargets ?? defaultAkanGlobalConfig.testTargets
+    };
+  }
+  static async#setAkanGlobalConfig(akanConfig) {
+    await mkdir(basePath, { recursive: true, mode: 448 });
+    const temp = `${configPath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    try {
+      await writeFile(temp, JSON.stringify(akanConfig, null, 2), { mode: 384 });
+      await FileSys2.replace(temp, configPath);
+    } catch (error) {
+      await rm(temp, { force: true });
+      throw error;
+    }
+  }
+  static #lockPath = `${configPath}.lock`;
+  static async#update(mutate) {
+    await ConfigLock.run(GlobalConfig.#lockPath, async () => {
+      await GlobalConfig.#setAkanGlobalConfig(mutate(await GlobalConfig.#getAkanGlobalConfig()));
+    });
+  }
+  static async hostFor(workspace, host) {
+    return GlobalConfig.#normalizeHost(host || ((await workspace.getConfig()).cloudHost ?? GlobalConfig.akanCloudHost));
+  }
+  static #normalizeHost(host) {
+    const url = URL.canParse(host) ? new URL(host) : null;
+    return url && (url.protocol === "https:" || url.protocol === "http:") ? `${url.origin}${trimTrailingSlashes(url.pathname)}` : trimTrailingSlashes(host);
+  }
+  static async getHostConfig(host = GlobalConfig.akanCloudHost) {
+    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
+    return GlobalConfig.toHostConfig(akanConfig.cloudHost[host] ?? getDefaultHostConfig(host));
+  }
+  static async setHostConfig(config = getDefaultHostConfig()) {
+    await GlobalConfig.#update((akanConfig) => GlobalConfig.#withHost(akanConfig, config));
+  }
+  static #withHost(akanConfig, config) {
+    return {
+      ...akanConfig,
+      cloudHost: { ...akanConfig.cloudHost, [config.host]: GlobalConfig.toHostConfigDto(config) }
+    };
+  }
+  static async refreshHostAuth(host, refresh) {
+    try {
+      return await ConfigLock.run(GlobalConfig.#lockPath, async () => {
+        const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
+        const current = GlobalConfig.toHostConfig(akanConfig.cloudHost[host] ?? getDefaultHostConfig(host));
+        const accessToken = current.auth?.accessToken;
+        const refreshToken = accessToken?.refreshToken;
+        if (!accessToken || !refreshToken || !GlobalConfig.needRefreshToken(accessToken))
+          return current;
+        const claimed = {
+          ...current,
+          auth: { ...current.auth, accessToken: { ...accessToken, refreshToken: null } }
+        };
+        await GlobalConfig.#setAkanGlobalConfig(GlobalConfig.#withHost(akanConfig, claimed));
+        const next = await refresh(refreshToken).catch(() => null);
+        if (!next?.jwt)
+          return claimed;
+        const refreshed = { ...current, auth: { ...current.auth, accessToken: next } };
+        await GlobalConfig.#setAkanGlobalConfig(GlobalConfig.#withHost(await GlobalConfig.#getAkanGlobalConfig(), refreshed));
+        return refreshed;
+      });
+    } catch {
+      return await GlobalConfig.getHostConfig(host);
+    }
+  }
+  static async getRemoteEnvServers() {
+    return (await GlobalConfig.#getAkanGlobalConfig()).remoteEnvServers;
+  }
+  static async setRemoteEnvServer(name, config) {
+    await GlobalConfig.#update((akanConfig) => ({
+      ...akanConfig,
+      remoteEnvServers: { ...akanConfig.remoteEnvServers, [name]: config }
+    }));
+  }
+  static async removeRemoteEnvServer(name) {
+    await GlobalConfig.#update((akanConfig) => {
+      const { [name]: _, ...remoteEnvServers } = akanConfig.remoteEnvServers;
+      return { ...akanConfig, remoteEnvServers };
+    });
+  }
+  static async getTestTargets() {
+    return (await GlobalConfig.#getAkanGlobalConfig()).testTargets;
+  }
+  static async setTestTargets(testTargets) {
+    await GlobalConfig.#update((akanConfig) => ({
+      ...akanConfig,
+      testTargets: { ...akanConfig.testTargets, ...testTargets }
+    }));
+  }
+  static needRefreshToken(accessToken) {
+    return !!accessToken?.expiresAt?.isBefore(dayjs().add(1, "hour"));
+  }
+  static toAccessToken(accessToken) {
+    return {
+      jwt: accessToken.jwt,
+      refreshToken: accessToken.refreshToken ?? null,
+      expiresAt: accessToken.expiresAt ? dayjs(accessToken.expiresAt) : null
+    };
+  }
+  static toAccessTokenDto(accessToken) {
+    return {
+      jwt: accessToken.jwt,
+      refreshToken: accessToken.refreshToken ?? null,
+      expiresAt: accessToken.expiresAt?.toString() ?? null
+    };
+  }
+  static toHostConfigDto(hostConfig) {
+    return {
+      host: hostConfig.host,
+      auth: {
+        accessToken: hostConfig.auth?.accessToken ? GlobalConfig.toAccessTokenDto(hostConfig.auth.accessToken) : undefined,
+        self: hostConfig.auth?.self
+      }
+    };
+  }
+  static toHostConfig(hostConfigDto) {
+    return {
+      host: hostConfigDto.host,
+      auth: {
+        accessToken: hostConfigDto.auth?.accessToken ? GlobalConfig.toAccessToken(hostConfigDto.auth.accessToken) : undefined,
+        self: hostConfigDto.auth?.self
+      }
+    };
+  }
+}
+
+// pkgs/@akanjs/devkit/cloud/cloudApi.ts
+class HttpClient {
+  baseUrl;
+  headers = {};
+  constructor(baseUrl, headers = {}) {
+    this.baseUrl = baseUrl;
+    this.headers = headers;
+  }
+  async get(url, { headers, signal } = {}) {
+    const response = await fetch(`${this.baseUrl}${url}`, {
+      headers: { "Content-Type": "application/json", ...this.headers, ...headers },
+      ...signal ? { signal } : {}
+    });
+    return await HttpClient.#body(response, url);
+  }
+  async getFile(url, localPath, headers) {
+    const response = await fetch(`${this.baseUrl}${url}`, {
+      headers: { ...this.headers, ...headers }
+    });
+    if (!response.ok)
+      throw await CloudHttpError.of(response, url);
+    await Bun.write(localPath, response);
+  }
+  async post(url, data, { headers, signal } = {}) {
+    const isFormData = data instanceof FormData;
+    const response = await fetch(`${this.baseUrl}${url}`, {
+      method: "POST",
+      body: isFormData ? data : JSON.stringify(data),
+      headers: isFormData ? { ...this.headers, ...headers } : { "Content-Type": "application/json", ...this.headers, ...headers },
+      ...signal ? { signal } : {}
+    });
+    return await HttpClient.#body(response, url);
+  }
+  static async#body(response, url) {
+    if (!response.ok)
+      throw await CloudHttpError.of(response, url);
+    return JSON.parse(await response.text());
+  }
+  setHeaders(headers) {
+    Object.assign(this.headers, headers);
+    return this;
+  }
+}
+
+class CloudApi {
+  static refusal(error, who, { unavailable } = {}) {
+    if (!(error instanceof CloudHttpError))
+      return error;
+    if (error.status === 401)
+      return new Error("The server did not accept your sign-in: run `akan login`, then try again.", { cause: error });
+    if (error.status === 403)
+      return new Error(`The project refused: ${who}.`, { cause: error });
+    if (error.status === 400)
+      return new Error(`The project refused the request${error.error ? `: ${error.error}` : ""}.`, { cause: error });
+    const { errKey } = error;
+    if (error.status === 503 && unavailable && errKey && errKey !== "base.error.serverUnavailable")
+      return new Error(`${unavailable}: ${errKey}.`, { cause: error });
+    return error;
+  }
+  #api;
+  #accessToken = null;
+  #workspace;
+  host;
+  url;
+  static async fromHost(workspace, host) {
+    const hostConfig = await GlobalConfig.getHostConfig(host);
+    const accessToken = hostConfig.auth?.accessToken;
+    if (!accessToken || !GlobalConfig.needRefreshToken(accessToken))
+      return new CloudApi(workspace, hostConfig);
+    const tokenless = new CloudApi(workspace, hostConfig);
+    const refreshed = await GlobalConfig.refreshHostAuth(hostConfig.host, (refreshToken) => tokenless.refreshAuthToken(refreshToken));
+    return new CloudApi(workspace, refreshed);
+  }
+  constructor(workspace, hostConfig) {
+    this.#workspace = workspace;
+    this.#accessToken = hostConfig.auth?.accessToken ?? null;
+    this.host = hostConfig.host;
+    this.url = `${this.host}/api`;
+    this.#api = new HttpClient(this.url);
+    if (this.#accessToken && !GlobalConfig.needRefreshToken(this.#accessToken))
+      this.#api.setHeaders({ Authorization: `Bearer ${this.#accessToken.jwt}` });
+  }
+  #authorize(accessTokenDto) {
+    this.#accessToken = GlobalConfig.toAccessToken(accessTokenDto);
+    this.#api.setHeaders({ Authorization: `Bearer ${this.#accessToken.jwt}` });
+    return this.#accessToken;
+  }
+  async uploadEnv(devProjectId, file) {
+    const formData = new FormData;
+    formData.append("devProjectId", devProjectId);
+    formData.append("file", file);
+    return await this.#api.post(`/uploadEnv/${devProjectId}`, formData);
+  }
+  async uploadSecret(devProjectId, secret) {
+    return await this.#api.post(`/uploadSecret/${encodeURIComponent(devProjectId)}`, secret);
+  }
+  async listSecrets(devProjectId) {
+    return await this.#api.get(`/listSecrets/${encodeURIComponent(devProjectId)}`);
+  }
+  async removeSecret(devProjectId, secret) {
+    return await this.#api.post(`/removeSecret/${encodeURIComponent(devProjectId)}`, secret);
+  }
+  async requestUpdateUpload(devProjectId, upload) {
+    return await this.#api.post(`/requestUpdateUpload/${encodeURIComponent(devProjectId)}`, upload);
+  }
+  async commitUpdateUpload(devProjectId, uploadId) {
+    return await this.#api.post(`/commitUpdateUpload/${encodeURIComponent(devProjectId)}`, { uploadId }, { signal: AbortSignal.timeout(11 * 60000) });
+  }
+  async registerAppBinary(devProjectId, binary) {
+    const formData = new FormData;
+    for (const key of ["appName", "target", "distribution"])
+      formData.append(key, binary[key]);
+    if (binary.channel)
+      formData.append("channel", binary.channel);
+    formData.append("bundle", binary.bundle, "bundle.json");
+    formData.append("packUploadId", binary.packUploadId);
+    return await this.#api.post(`/registerAppBinary/${encodeURIComponent(devProjectId)}`, formData, {
+      signal: AbortSignal.timeout(11 * 60000)
+    });
+  }
+  async downloadEnv(devProjectId) {
+    const localPath = `${this.#workspace.workspaceRoot}/local/env.tar`;
+    await this.#api.getFile(`/downloadEnv/${devProjectId}`, localPath);
+    return localPath;
+  }
+  async getRemoteAuthToken(remoteId) {
+    try {
+      return this.#authorize(await this.#api.get(`/getRemoteAuthToken/${remoteId}`));
+    } catch (_) {
+      return null;
+    }
+  }
+  async refreshAuthToken(refreshToken) {
+    return this.#authorize(await this.#api.post(`/refreshAuthToken`, { refreshToken }, { signal: AbortSignal.timeout(20000) }));
+  }
+  async requestTunnel(input) {
+    return await this.#api.post(`/tunnel/requestTunnel`, input);
+  }
+  async tunnelListInSelf() {
+    return await this.#api.get(`/tunnel/tunnelListInSelf`);
+  }
+  async revokeTunnel(code) {
+    return await this.#api.post(`/tunnel/revokeTunnel`, { code }, { signal: AbortSignal.timeout(5000) });
+  }
+  async getRemoteSelf() {
+    try {
+      return await this.#api.get(`/getRemoteSelf`);
+    } catch {
+      return null;
+    }
+  }
+}
+// pkgs/@akanjs/devkit/cloud/cloudUpdates.ts
+import path2 from "path";
+import { Logger as Logger2 } from "akanjs/common";
+
+// pkgs/@akanjs/devkit/cloud/updatePackUpload.ts
+import { Logger, sleep } from "akanjs/common";
+class UpdatePackUpload {
+  static maxBytes = 200 * 1024 * 1024;
+  static #transientPut = new Set([0, 408, 429, 500, 502, 503, 504]);
+  static #putFloorBytesPerSecond = 64 * 1024;
+  static #maxPutRetryAfterMs = 60000;
+  #api;
+  #devProjectId;
+  #putRetryMs;
+  #putTimeoutMs;
+  #commitRetryMs;
+  #cutOffWindowMs;
+  #commitLimitMs;
+  constructor(api, devProjectId, {
+    putRetryMs = 1000,
+    putTimeoutMs = 60000,
+    commitRetryMs = 1e4,
+    cutOffWindowMs = 15 * 60000,
+    commitLimitMs = 60 * 60000
+  } = {}) {
+    this.#api = api;
+    this.#devProjectId = devProjectId;
+    this.#putRetryMs = putRetryMs;
+    this.#putTimeoutMs = putTimeoutMs;
+    this.#commitRetryMs = commitRetryMs;
+    this.#cutOffWindowMs = cutOffWindowMs;
+    this.#commitLimitMs = commitLimitMs;
+  }
+  async send(archive, fields) {
+    const uploadId = await this.stage(archive, fields);
+    return await this.settle(() => this.#api.commitUpdateUpload(this.#devProjectId, uploadId));
+  }
+  async stage(archive, fields) {
+    const file = Bun.file(archive);
+    if (file.size < 1 || file.size > UpdatePackUpload.maxBytes)
+      throw new Error(`The pack archive is ${file.size} bytes; a project takes 1 byte to 200 MiB.`);
+    const hasher = new Bun.CryptoHasher("sha256");
+    for await (const chunk of file.stream())
+      hasher.update(chunk);
+    const upload = { ...fields, size: file.size, sha256: hasher.digest("hex") };
+    for (let ticket = 1;; ticket++) {
+      const { uploadId, uploadUrl, contentType } = await this.#request(upload);
+      const status = await this.#put(uploadUrl, contentType, file);
+      if (status >= 200 && status < 300)
+        return uploadId;
+      if (status !== 403 || ticket === 2)
+        throw new Error(`The storage refused the pack upload (${status ? `HTTP ${status}` : "no response"}).`);
+    }
+  }
+  async#request(upload) {
+    return await this.#api.requestUpdateUpload(this.#devProjectId, upload).catch((error) => {
+      if (error instanceof CloudHttpError && error.status === 404 && !error.errKey)
+        throw new Error("The project's server does not take direct pack uploads yet: update Akan Cloud and try again, or upload the pack from the project's release screen.");
+      throw error;
+    });
+  }
+  async#put(url, contentType, file) {
+    const timeoutMs = this.#putTimeoutMs + Math.ceil(file.size / UpdatePackUpload.#putFloorBytesPerSecond * 1000);
+    for (let retry = 0;; retry++) {
+      const { status, retryAfterMs } = await fetch(url, {
+        method: "PUT",
+        body: file,
+        headers: { "Content-Type": contentType },
+        signal: AbortSignal.timeout(timeoutMs)
+      }).then(async (response) => {
+        await response.arrayBuffer().catch(() => {
+          return;
+        });
+        return {
+          status: response.status,
+          retryAfterMs: CloudHttpError.retryAfterMs(response.headers.get("retry-after"))
+        };
+      }).catch(() => ({ status: 0, retryAfterMs: null }));
+      if (retry === 3 || !UpdatePackUpload.#transientPut.has(status))
+        return status;
+      await sleep(Math.max(this.#putRetryMs * (retry + 1), Math.min(retryAfterMs ?? 0, UpdatePackUpload.#maxPutRetryAfterMs)));
+    }
+  }
+  async settle(call) {
+    const limit = performance.now() + this.#commitLimitMs;
+    let cutOffSince = null;
+    for (;; ) {
+      try {
+        return await call();
+      } catch (error) {
+        const now = performance.now();
+        if (UpdatePackUpload.#inProgress(error))
+          cutOffSince = null;
+        else if (UpdatePackUpload.#cutOff(error))
+          cutOffSince ??= now;
+        else
+          throw error;
+        const deadline = cutOffSince === null ? limit : Math.min(limit, cutOffSince + this.#cutOffWindowMs);
+        const waitMs = Math.max(this.#commitRetryMs, error instanceof CloudHttpError && error.retryAfterMs || 0);
+        if (now + waitMs > deadline)
+          throw error;
+        Logger.rawLog(`The project is still taking the pack; asking again in ${Math.round(waitMs / 1000)}s.`);
+        await sleep(waitMs);
+      }
+    }
+  }
+  static #inProgress(error) {
+    return error instanceof CloudHttpError && error.status === 409 && !!error.errKey?.endsWith(".uploadCommitInProgress");
+  }
+  static #cutOff(error) {
+    if (!(error instanceof CloudHttpError))
+      return !(error instanceof SyntaxError);
+    const { status, errKey } = error;
+    if (status === 503)
+      return errKey === null || errKey === "base.error.serverUnavailable";
+    return status === 502 || status === 504 || status >= 520 && status <= 527;
+  }
+}
+
+// pkgs/@akanjs/devkit/cloud/cloudUpdates.ts
+class CloudUpdates {
+  cloudApi;
+  devProjectId;
+  constructor(cloudApi, devProjectId) {
+    this.cloudApi = cloudApi;
+    this.devProjectId = devProjectId;
+  }
+  static async storeBundlePath(app, target, platform) {
+    const [mobileTarget] = await resolveMobileTargets(app, target);
+    if (!mobileTarget)
+      throw new Error(`Native target '${target}' was not found.`);
+    return path2.join(new NativeApp(app, mobileTarget).outDir(platform), UpdatePackFolder.bundleFile);
+  }
+  static async readPack(app, dir, {
+    platform,
+    target,
+    env,
+    allowLocalRelease
+  }) {
+    const pack = await UpdatePackFolder.read(dir);
+    const what = `The pack in ${pack.out} is ${pack.app} ${pack.target} ${pack.platform} --env ${pack.env}`;
+    if (pack.app !== app.name)
+      throw new Error(`${what}, not ${app.name}'s.`);
+    if (platform && platform !== pack.platform)
+      throw new Error(`${what}, not ${platform}.`);
+    if (env && env !== pack.env)
+      throw new Error(`${what}, not --env ${env}.`);
+    if (target) {
+      const targets = (await resolveMobileTargets(app, target)).map(({ name }) => name);
+      if (targets.length !== 1 || targets[0] !== pack.target)
+        throw new Error(`${what}, not --target ${target} (${targets.join(", ")}).`);
+    }
+    if (pack.env === "local" && !allowLocalRelease)
+      throw new Error(`${what}, and a local pack is blocked. Pass --allow-local-release only for explicit local release testing.`);
+    return pack;
+  }
+  async push(pack, { channel, notes }) {
+    const target = channel ?? pack.channel;
+    return await UpdatePackFolder.withArchive(pack, async (archive) => {
+      const release = await new UpdatePackUpload(this.cloudApi, this.devProjectId).send(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel: target, notes }).catch((error) => {
+        throw CloudApi.refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
+      });
+      const label = `${pack.app} ${pack.target} ${pack.platform} on channel ${target}: release ${release.id}`;
+      if (release.status === "rejected")
+        throw new ExitCodeError(`The project rejected ${label}:
+${(release.problems ?? []).map((problem) => `  - ${problem}`).join(`
+`)}`, 2);
+      if (release.status === "published")
+        Logger2.rawLog(`Published ${label} (${pack.files} files, native API ${pack.nativeApi}).`);
+      else
+        Logger2.rawLog(`Staged ${label} (${pack.files} files, native API ${pack.nativeApi}). Publish it from the project's release screen.`);
+      return release;
+    });
+  }
+  async registerBinary(app, pack, { distribution, env }) {
+    const { cloudApi, devProjectId } = this;
+    const bundlePath = await CloudUpdates.storeBundlePath(app, pack.target, pack.platform);
+    const bundleFile = Bun.file(bundlePath);
+    const rebuild = `akan release-${pack.platform} ${app.name} --target ${pack.target} --env ${env}`;
+    if (!await bundleFile.exists())
+      throw new Error(`No store build at ${bundlePath}: run \`${rebuild}\` first.`);
+    const bundle = await UpdatePackFolder.readBundle(bundlePath);
+    if (!bundle.updates)
+      throw new Error(`The store build at ${bundlePath} takes no updates: give the target native.updates.`);
+    const packBundle = path2.join(pack.out, UpdatePackFolder.bundleFile);
+    const envProblem = await NativePublicEnv.problemAgainst(bundlePath, packBundle);
+    if (envProblem)
+      throw new ExitCodeError(`The pack in ${pack.out} cannot run in the store build: ${envProblem}.`, 2);
+    if (bundle.web.hash !== pack.webHash)
+      throw new Error(`The store build at ${bundlePath} is not this commit's --env ${env} build: its web bundle differs from the pack's. Run \`${rebuild}\`, then register that build.`);
+    const compat = await NativeApp.compareBundles(app.cwdPath, bundlePath, packBundle);
+    const verdict = UpdatePackFolder.storeBuildVerdict({ out: pack.out, compat: { against: bundlePath, ...compat } }, `Run \`${rebuild}\`, then register that build.`);
+    if (verdict)
+      throw verdict;
+    if (bundle.updates.channel !== pack.channel)
+      throw new Error(`The store build at ${bundlePath} reads updates channel ${bundle.updates.channel}, and this commit's --env ${env} pack is for ${pack.channel}. Run \`${rebuild}\`, then register that build.`);
+    const { channel } = pack;
+    const upload = new UpdatePackUpload(cloudApi, devProjectId);
+    return await UpdatePackFolder.withArchive(pack, async (archive) => {
+      const binary = await upload.stage(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel, notes: null }).then((packUploadId) => upload.settle(() => cloudApi.registerAppBinary(devProjectId, {
+        appName: pack.app,
+        target: pack.target,
+        distribution,
+        bundle: bundleFile,
+        packUploadId,
+        channel
+      }))).catch((error) => {
+        throw CloudApi.refusal(error, "a binary is registered by a project member signed in with `akan login`");
+      });
+      Logger2.rawLog(`Registered ${pack.app} ${pack.target} ${pack.platform} (${distribution}): binary ${binary.id}, native API ${pack.nativeApi}.`);
+      return binary;
+    });
+  }
+}
+// pkgs/@akanjs/devkit/cloud/pipelineSecrets.ts
+import { capitalize, Logger as Logger3, PipelineNames } from "akanjs/common";
+class PipelineSecrets {
+  cloudApi;
+  devProjectId;
+  static #secretBytes = 64 * 1024;
+  static #secretBranches = ["debug", "develop", "main"];
+  static #secretsUnavailable = "The server is not configured for pipeline secrets yet";
+  constructor(cloudApi, devProjectId) {
+    this.cloudApi = cloudApi;
+    this.devProjectId = devProjectId;
+  }
+  static async readValue(name, file) {
+    const raw = file ? await Bun.file(file).text() : process.stdin.isTTY ? await (await import("@inquirer/prompts")).password({
+      message: `Value of ${name} (hidden; it can never be read back)`,
+      mask: "*"
+    }) : await PipelineSecrets.#readStdin(name);
+    const value = raw.replace(/\r?\n$/, "");
+    if (!value)
+      throw new Error(`The value of ${name} is empty.`);
+    const bytes = new TextEncoder().encode(value).length;
+    if (bytes > PipelineSecrets.#secretBytes)
+      throw new Error(`The value of ${name} is ${bytes} bytes, over ${PipelineSecrets.#secretBytes}.`);
+    return value;
+  }
+  static async#readStdin(name) {
+    process.stderr.write(`Reading the value of ${name} from stdin until it closes (or pass --file <path>).
+`);
+    return await Bun.stdin.text();
+  }
+  async upload({ name, branch, value }) {
+    PipelineSecrets.assertName(name);
+    PipelineSecrets.assertBranch(branch);
+    const saved = await this.cloudApi.uploadSecret(this.devProjectId, { scope: branch ?? "*", name, value }).catch((error) => {
+      throw CloudApi.refusal(error, "a secret is written by a project member signed in with `akan login`", {
+        unavailable: PipelineSecrets.#secretsUnavailable
+      });
+    });
+    Logger3.rawLog(`Saved ${saved.name} for ${saved.scope === "*" ? "every branch" : `branch ${saved.scope}`}. Builds that start from now on use it.`);
+  }
+  async list(branch) {
+    PipelineSecrets.assertBranch(branch);
+    const listed = await this.cloudApi.listSecrets(this.devProjectId).catch((error) => {
+      throw CloudApi.refusal(error, "the secrets are listed for a project member", {
+        unavailable: PipelineSecrets.#secretsUnavailable
+      });
+    });
+    const secrets = listed.filter((secret) => !branch || secret.scope === "*" || secret.scope === branch);
+    Logger3.rawLog(PipelineSecrets.format(secrets));
+  }
+  async remove({ name, branch }) {
+    PipelineSecrets.assertName(name);
+    PipelineSecrets.assertBranch(branch);
+    const removed = await this.cloudApi.removeSecret(this.devProjectId, { scope: branch ?? "*", name }).catch((error) => {
+      throw CloudApi.refusal(error, "a secret is removed by a project member signed in with `akan login`", {
+        unavailable: PipelineSecrets.#secretsUnavailable
+      });
+    });
+    Logger3.rawLog(removed ? `Removed ${name} for ${branch ? `branch ${branch}` : "every branch"}.` : `No ${name} for ${branch ? `branch ${branch}` : "every branch"} to remove.`);
+  }
+  static format(secrets) {
+    if (!secrets.length)
+      return "No pipeline secrets.";
+    const rows = [...secrets].sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope)).map((secret) => [secret.name, secret.scope === "*" ? "every branch" : secret.scope, secret.updatedAt, secret.updatedBy].map((cell) => String(cell ?? "-")));
+    const header = ["NAME", "SCOPE", "UPDATED", "BY"];
+    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0)));
+    return [header, ...rows].map((row) => row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()).join(`
+`);
+  }
+  static assertName(name) {
+    const problem = PipelineNames.secretNameError(name);
+    if (problem)
+      throw new Error(`${capitalize(problem)}.`);
+  }
+  static assertBranch(branch) {
+    if (branch !== null && !PipelineSecrets.#secretBranches.includes(branch))
+      throw new Error(`--branch ${branch} is not a deployed branch: ${PipelineSecrets.#secretBranches.join(", ")}.`);
+  }
+}
+export { getDefaultHostConfig, GlobalConfig, CloudApi, CloudUpdates, PipelineSecrets };