@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.11

package/{index-8ggztp8k.js → index-fyq1z6kt.js}

@@ -3,28 +3,43 @@ import {
   getDefaultHostConfig,
   GlobalConfig,
   CloudApi,
-  UpdatePackUpload
-} from "./index-pgj2rt78.js";
-import {
-  runner
-} from "./index-6jjtnhkw.js";
+  CloudUpdates,
+  PipelineSecrets
+} from "./index-cpb3nvma.js";
 import {
   WorkspaceExecutor,
   AppExecutor
-} from "./index-55mynnqs.js";
+} from "./index-va06nr10.js";
 import {
-  NativeApp
-} from "./index-1w2qaee2.js";
+  runner,
+  assertPromptable
+} from "./index-jw1zm273.js";
 import {
   SubspaceConfig
-} from "./index-ww9bhp67.js";
-import {
-  resolveMobileTargets
-} from "./index-q958tqqg.js";
+} from "./index-4pf8g7ff.js";
 import {
   openBrowser
 } from "./index-9dp031by.js";
 
+// pkgs/@akanjs/cli/npmRegistry.ts
+var defaultNpmRegistry = "https://registry.npmjs.org";
+var getNpmRegistryUrl = (registryUrl = process.env.AKAN_NPM_REGISTRY ?? defaultNpmRegistry) => registryUrl.replace(/\/+$/, "");
+async function getLatestPackageVersion(packageName, tag = "latest", registryUrl) {
+  const registry = getNpmRegistryUrl(registryUrl);
+  const url = `${registry}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
+  const res = await fetch(url);
+  if (!res.ok)
+    throw new Error(`Failed to fetch ${packageName} metadata from ${registry}`);
+  const metadata = await res.json();
+  const version = metadata["dist-tags"]?.[tag];
+  if (!version)
+    throw new Error(`No npm dist-tag "${tag}" found for ${packageName}`);
+  return version;
+}
+
+// pkgs/@akanjs/cli/cloud/cloud.runner.ts
+import path7 from "path";
+
 // pkgs/@akanjs/devkit/platformTest/PlatformTestRun.ts
 import path6 from "path";
 import chalk from "chalk";
@@ -212,11 +227,13 @@ class PlatformTestTarget {
     const install = await this.exec("bun install --frozen-lockfile", logPath, PlatformTestTarget.installIdleMs);
     if (install.exitCode === 0)
       return;
-    const failedScripts = [...install.output.matchAll(/(?:pre|post)?install script from "([^"]+)" exited/g)].map((match) => match[1] ?? "");
-    const tolerable = failedScripts.length > 0 && failedScripts.every((pkg) => this.tolerateScriptFailures.includes(pkg));
+    const failedPackages = [
+      ...install.output.matchAll(/(?:pre|post)?install script from "([^"]+)" exited|failed to link binaries for package: (@?[^@\s]+)@/g)
+    ].map((match) => match[1] ?? match[2] ?? "");
+    const tolerable = failedPackages.length > 0 && failedPackages.every((pkg) => this.tolerateScriptFailures.includes(pkg));
     if (!tolerable)
       throw new Error(`bun install failed \u2014 see ${logPath}`);
-    envWarnings.push(`install script failed for ${failedScripts.join(", ")} \u2014 tolerated on ${this.platform}`);
+    envWarnings.push(`install failed for ${failedPackages.join(", ")} \u2014 tolerated on ${this.platform}`);
     const relink = await this.exec("bun install --frozen-lockfile --ignore-scripts", this.#logPath(context, "install-relink"), PlatformTestTarget.installIdleMs);
     if (relink.exitCode !== 0)
       throw new Error(`bun install --ignore-scripts failed \u2014 see ${logPath}`);
@@ -253,7 +270,7 @@ class LinuxDockerTarget extends PlatformTestTarget {
   }
   static dockerfile = [
     `FROM oven/bun:${Bun.version}-slim`,
-    "RUN apt-get update && apt-get install -y --no-install-recommends git ca-certificates procps lsof && rm -rf /var/lib/apt/lists/*"
+    "RUN sed -i 's|http://|https://|g' /etc/apt/sources.list.d/debian.sources && apt-get update && apt-get install -y --no-install-recommends git ca-certificates procps lsof && rm -rf /var/lib/apt/lists/*"
   ].join(`
 `);
   get image() {
@@ -416,7 +433,7 @@ import path5 from "path";
 class WindowsSshTarget extends PlatformTestTarget {
   static utmctlPath = "/Applications/UTM.app/Contents/MacOS/utmctl";
   static defaultWorkRoot = "C:\\akan-test";
-  static defaultTolerateScriptFailures = ["sharp", "puppeteer"];
+  static defaultTolerateScriptFailures = ["sharp", "puppeteer", "msgpackr"];
   static #runDirPattern = "^\\d{8}-\\d{6}$";
   static #keptRuns = 2;
   platform = "windows";
@@ -657,31 +674,10 @@ class PlatformTestRun {
 }
 
 // pkgs/@akanjs/cli/cloud/cloud.runner.ts
-import { rm } from "fs/promises";
-import os3 from "os";
-import path7 from "path";
-import { confirm, input, password, select } from "@inquirer/prompts";
-import { Logger, PipelineNames, sleep } from "akanjs/common";
+import { confirm, input, select } from "@inquirer/prompts";
+import { Logger, sleep } from "akanjs/common";
 import chalk2 from "chalk";
 import * as QRcode from "qrcode";
-
-// pkgs/@akanjs/cli/npmRegistry.ts
-var defaultNpmRegistry = "https://registry.npmjs.org";
-var getNpmRegistryUrl = (registryUrl = process.env.AKAN_NPM_REGISTRY ?? defaultNpmRegistry) => registryUrl.replace(/\/+$/, "");
-async function getLatestPackageVersion(packageName, tag = "latest", registryUrl) {
-  const registry = getNpmRegistryUrl(registryUrl);
-  const url = `${registry}/${encodeURIComponent(packageName).replace(/^%40/, "@")}`;
-  const res = await fetch(url);
-  if (!res.ok)
-    throw new Error(`Failed to fetch ${packageName} metadata from ${registry}`);
-  const metadata = await res.json();
-  const version = metadata["dist-tags"]?.[tag];
-  if (!version)
-    throw new Error(`No npm dist-tag "${tag}" found for ${packageName}`);
-  return version;
-}
-
-// pkgs/@akanjs/cli/cloud/cloud.runner.ts
 var addRemoteEnvServerValue = "__addRemoteEnvServer";
 var removeRemoteEnvServerValue = "__removeRemoteEnvServer";
 
@@ -766,6 +762,9 @@ class CloudRunner extends runner("cloud") {
     return { name: `${name} (${this.#getSshTarget(config)}${config.port ? `:${config.port}` : ""})`, value: name };
   }
   async#getRemoteEnvServerWithUsername() {
+    assertPromptable("The env archive goes over scp to a remote server picked here, as AKAN_WORKSPACE_ID is not set", {
+      remedy: "set AKAN_WORKSPACE_ID in the workspace .env to use Akan Cloud, or run it once in a terminal"
+    });
     const remoteServer = await this.#selectRemoteEnvServer();
     if (remoteServer.config.username)
       return remoteServer;
@@ -891,6 +890,9 @@ ${run.format(results)}
       const reason = result.infraError ?? "failing tests";
       if (!interactive)
         continue;
+      assertPromptable(`${result.platform} did not pass (${reason}) \u2014 ${run.logDir}`, {
+        remedy: "leave it out of --platforms to publish without it, or run it in a terminal to be asked"
+      });
       const proceed = await confirm({
         message: `${result.platform} did not pass (${reason}). Continue without it?`,
         default: false
@@ -909,6 +911,9 @@ ${run.format(results)}
     return results;
   }
   async#askWindowsTestTarget() {
+    assertPromptable("No Windows test target is configured", {
+      remedy: "run it once in a terminal, which saves the target to ~/.akan/config.json"
+    });
     Logger.info("No Windows test target is configured yet; it is saved to ~/.akan/config.json once entered.");
     const required = (value) => !!value.trim();
     const host = await this.#ask("Windows host (ip or name): ", required);
@@ -944,11 +949,15 @@ ${run.format(results)}
     for (const library of akanPkgs) {
       const packageJson = await workspace.readJson(`pkgs/${library}/package.json`);
       const newPackageJson = this.#normalizeAkanPackageJson(packageJson, library, nextVersion);
-      await workspace.writeFile(`pkgs/${library}/package.json`, JSON.stringify(newPackageJson, null, 2));
+      await workspace.writeJson(`pkgs/${library}/package.json`, newPackageJson);
       const distPackageJson = await workspace.readJson(`dist/pkgs/${library}/package.json`);
       const newDistPackageJson = this.#normalizeAkanPackageJson(distPackageJson, library, nextVersion);
       await workspace.writeJson(`dist/pkgs/${library}/package.json`, newDistPackageJson);
     }
+    if (confirmPublish)
+      assertPromptable(`Publishing ${akanPkgs.join(", ")}@${nextVersion} asks for a confirmation`, {
+        remedy: "run it in a terminal"
+      });
     if (confirmPublish && !await confirm({ message: "Are you sure you want to deploy the libraries?" })) {
       Logger.error("Deployment cancelled");
       return;
@@ -1014,7 +1023,7 @@ ${run.format(results)}
   async downloadEnv(cloudApi, workspace, workspaceId) {
     await workspace.mkdir("local");
     const localPath = await cloudApi.downloadEnv(workspaceId).catch((error) => {
-      throw CloudRunner.#refusal(error, "downloading its env archive takes the project owner's own `akan login`");
+      throw CloudApi.refusal(error, "downloading its env archive takes the project owner's own `akan login`");
     });
     const relativePath = path7.relative(workspace.workspaceRoot, localPath).split(path7.sep).join("/");
     await workspace.spawn("tar", ["-xf", relativePath], { cwd: workspace.workspaceRoot });
@@ -1023,7 +1032,7 @@ ${run.format(results)}
   async uploadEnv(cloudApi, workspaceId, filePath) {
     const file = new File([Bun.file(filePath)], path7.basename(filePath));
     await cloudApi.uploadEnv(workspaceId, file).catch((error) => {
-      throw CloudRunner.#refusal(error, "an env archive is uploaded by a project member signed in with `akan login`");
+      throw CloudApi.refusal(error, "an env archive is uploaded by a project member signed in with `akan login`");
     });
   }
   async downloadEnvByScp(workspace) {
@@ -1096,7 +1105,7 @@ ${run.format(results)}
     }));
     return secretPaths.flat();
   }
-  async secretProject(workspace, subspace) {
+  async projectOf(workspace, subspace, appName) {
     if (!subspace) {
       const workspaceId = workspace.getWorkspaceId({ allowEmpty: true });
       if (!workspaceId)
@@ -1109,172 +1118,30 @@ ${run.format(results)}
     const [declaration] = config.select([subspace]);
     if (!declaration?.workspaceId)
       throw new Error(`Subspace "${subspace}" declares no workspaceId in ${SubspaceConfig.source}.`);
+    if (appName && !declaration.apps.includes(appName))
+      throw new Error(`Subspace "${subspace}" declares no app ${appName} in ${SubspaceConfig.source}; it serves ${declaration.apps.join(", ")}.`);
     return declaration.workspaceId;
   }
   async readSecretValue(name, file) {
-    const raw = file ? await Bun.file(file).text() : process.stdin.isTTY ? await password({ message: `Value of ${name} (hidden; it can never be read back)`, mask: "*" }) : await Bun.stdin.text();
-    const value = raw.replace(/\r?\n$/, "");
-    if (!value)
-      throw new Error(`The value of ${name} is empty.`);
-    const bytes = new TextEncoder().encode(value).length;
-    if (bytes > CloudRunner.#secretBytes)
-      throw new Error(`The value of ${name} is ${bytes} bytes, over ${CloudRunner.#secretBytes}.`);
-    return value;
-  }
-  async uploadSecret(cloudApi, devProjectId, { name, branch, value }) {
-    CloudRunner.#assertSecretName(name);
-    CloudRunner.#assertSecretBranch(branch);
-    const saved = await cloudApi.uploadSecret(devProjectId, { scope: branch ?? "*", name, value }).catch((error) => {
-      throw CloudRunner.#refusal(error, "a secret is written by a project member signed in with `akan login`", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    Logger.rawLog(`Saved ${saved.name} for ${saved.scope === "*" ? "every branch" : `branch ${saved.scope}`}. Builds that start from now on use it.`);
+    return await PipelineSecrets.readValue(name, file);
+  }
+  async uploadSecret(cloudApi, devProjectId, secret) {
+    await new PipelineSecrets(cloudApi, devProjectId).upload(secret);
   }
   async listSecrets(cloudApi, devProjectId, branch) {
-    CloudRunner.#assertSecretBranch(branch);
-    const listed = await cloudApi.listSecrets(devProjectId).catch((error) => {
-      throw CloudRunner.#refusal(error, "the secrets are listed for a project member", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    const secrets = listed.filter((secret) => !branch || secret.scope === "*" || secret.scope === branch);
-    Logger.rawLog(CloudRunner.formatSecrets(secrets));
-  }
-  async removeSecret(cloudApi, devProjectId, { name, branch }) {
-    CloudRunner.#assertSecretName(name);
-    CloudRunner.#assertSecretBranch(branch);
-    const removed = await cloudApi.removeSecret(devProjectId, { scope: branch ?? "*", name }).catch((error) => {
-      throw CloudRunner.#refusal(error, "a secret is removed by a project member signed in with `akan login`", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    Logger.rawLog(removed ? `Removed ${name} for ${branch ? `branch ${branch}` : "every branch"}.` : `No ${name} for ${branch ? `branch ${branch}` : "every branch"} to remove.`);
-  }
-  static #packRecords = ["manifest.template.json", "bundle.json", "pack.json", "compat.json"];
-  static async#tarPack(pack) {
-    const templateFile = Bun.file(path7.join(pack.out, "manifest.template.json"));
-    if (!await templateFile.exists())
-      throw new Error(`${pack.out} holds no manifest.template.json: give the folder \`akan pack-update\` wrote.`);
-    const template = await templateFile.json();
-    const hashes = new Set((template.files ?? []).map((file) => file.sha256));
-    if (![...hashes].every((hash) => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)))
-      throw new Error(`${pack.out}/manifest.template.json lists a file whose sha256 is not 64 hex digits.`);
-    const present = await Promise.all(CloudRunner.#packRecords.map((name) => Bun.file(path7.join(pack.out, name)).exists()));
-    const entries = [
-      ...CloudRunner.#packRecords.filter((_, idx) => present[idx]),
-      ...[...hashes].map((hash) => `files/${hash}`)
-    ];
-    const base = path7.join(os3.tmpdir(), `akan-pack-${pack.app}-${pack.target}-${pack.platform}-${process.pid}`);
-    await Bun.write(`${base}.list`, entries.map((entry) => `./${entry}
-`).join(""));
-    try {
-      const tar = Bun.spawn(["tar", "-czf", `${base}.tgz`, "-C", pack.out, "-T", `${base}.list`], {
-        stdout: "ignore",
-        stderr: "pipe"
-      });
-      if (await tar.exited !== 0)
-        throw new Error(`tar of ${pack.out} failed: ${(await new Response(tar.stderr).text()).trim()}`);
-    } finally {
-      await rm(`${base}.list`, { force: true });
-    }
-    return `${base}.tgz`;
+    await new PipelineSecrets(cloudApi, devProjectId).list(branch);
   }
-  async pushUpdate(cloudApi, devProjectId, pack, { channel, notes }) {
-    const archive = await CloudRunner.#tarPack(pack);
-    const target = channel ?? pack.channel;
-    try {
-      const release = await new UpdatePackUpload(cloudApi, devProjectId).send(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel: target, notes }).catch((error) => {
-        throw CloudRunner.#refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
-      });
-      const label = `${pack.app} ${pack.target} ${pack.platform} on channel ${target}: release ${release.id}`;
-      if (release.status === "rejected") {
-        process.exitCode = 2;
-        Logger.error(`The project rejected ${label}:
-${(release.problems ?? []).map((problem) => `  - ${problem}`).join(`
-`)}`);
-      } else if (release.status === "published")
-        Logger.rawLog(`Published ${label} (${pack.files} files, native API ${pack.nativeApi}).`);
-      else
-        Logger.rawLog(`Staged ${label} (${pack.files} files, native API ${pack.nativeApi}). Publish it from the project's release screen.`);
-      return release;
-    } finally {
-      await rm(archive, { force: true });
-    }
+  async removeSecret(cloudApi, devProjectId, secret) {
+    await new PipelineSecrets(cloudApi, devProjectId).remove(secret);
   }
-  async registerBinary(cloudApi, devProjectId, app, pack, { distribution, env }) {
-    const [mobileTarget] = await resolveMobileTargets(app, pack.target);
-    if (!mobileTarget)
-      throw new Error(`Native target '${pack.target}' was not found.`);
-    const bundlePath = path7.join(new NativeApp(app, mobileTarget).outDir(pack.platform), "bundle.json");
-    const bundleFile = Bun.file(bundlePath);
-    if (!await bundleFile.exists())
-      throw new Error(`No store build at ${bundlePath}: run \`akan release-${pack.platform} ${app.name} --target ${pack.target} --env ${env}\` first.`);
-    const bundle = await bundleFile.json();
-    if (!bundle.updates)
-      throw new Error(`The store build at ${bundlePath} takes no updates: give the target native.updates.`);
-    if (bundle.nativeApi?.hash !== pack.nativeApi)
-      throw new Error(`The store build at ${bundlePath} provides native API ${bundle.nativeApi?.hash}, and this commit's pack needs ${pack.nativeApi}: build the store binary from this commit.`);
-    const archive = await CloudRunner.#tarPack(pack);
-    const channel = bundle.updates.channel ?? pack.channel;
-    const upload = new UpdatePackUpload(cloudApi, devProjectId);
-    try {
-      const binary = await upload.stage(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel, notes: null }).then((packUploadId) => upload.settle(() => cloudApi.registerAppBinary(devProjectId, {
-        appName: pack.app,
-        target: pack.target,
-        distribution,
-        bundle: bundleFile,
-        packUploadId,
-        channel
-      }))).catch((error) => {
-        throw CloudRunner.#refusal(error, "a binary is registered by a project member signed in with `akan login`");
-      });
-      Logger.rawLog(`Registered ${pack.app} ${pack.target} ${pack.platform} (${distribution}): binary ${binary.id}, native API ${pack.nativeApi}.`);
-      return binary;
-    } finally {
-      await rm(archive, { force: true });
-    }
+  async readPack(app, dir, flags) {
+    return await CloudUpdates.readPack(app, dir, flags);
   }
-  static formatSecrets(secrets) {
-    if (!secrets.length)
-      return "No pipeline secrets.";
-    const rows = [...secrets].sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope)).map((secret) => [
-      secret.name,
-      secret.scope === "*" ? "every branch" : secret.scope,
-      secret.updatedAt,
-      secret.updatedBy
-    ]);
-    const header = ["NAME", "SCOPE", "UPDATED", "BY"];
-    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0)));
-    return [header, ...rows].map((row) => row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()).join(`
-`);
+  async pushUpdate(cloudApi, devProjectId, pack, options) {
+    return await new CloudUpdates(cloudApi, devProjectId).push(pack, options);
   }
-  static #secretBytes = 64 * 1024;
-  static #secretBranches = ["debug", "develop", "main"];
-  static #secretsUnavailable = "The server is not configured for pipeline secrets yet.";
-  static #assertSecretName(name) {
-    const problem = PipelineNames.secretNameError(name);
-    if (problem)
-      throw new Error(problem);
-  }
-  static #assertSecretBranch(branch) {
-    if (branch !== null && !CloudRunner.#secretBranches.includes(branch))
-      throw new Error(`--branch ${branch} is not a deployed branch: ${CloudRunner.#secretBranches.join(", ")}.`);
-  }
-  static #refusal(error, who, { unavailable } = {}) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = CloudApi.statusOf(error);
-    if (status === 401)
-      return new Error("The server did not accept your sign-in: run `akan login`, then try again.");
-    if (status === 403)
-      return new Error(`The project refused: ${who}.`);
-    if (status === 400) {
-      const key = /"error"\s*:\s*"([^"]+)"/.exec(message)?.[1];
-      return new Error(`The project refused the request${key ? `: ${key}` : ""}.`);
-    }
-    if (status === 503 && unavailable)
-      return new Error(unavailable);
-    return error;
+  async registerBinary(cloudApi, devProjectId, app, pack, options) {
+    return await new CloudUpdates(cloudApi, devProjectId).registerBinary(app, pack, options);
   }
   async#syncSecretGitignore(workspace, appNames) {
     const patterns = (await Promise.all(appNames.map(async (appName) => {