@akanjs/cli 3.1.0-rc.1 → 3.1.0-rc.3

package/{index-gnyf1fqy.js → index-qvghfv6v.js}

@@ -2,13 +2,13 @@
 import {
   runner,
   script
-} from "./index-6jjtnhkw.js";
+} from "./index-3x7yeecy.js";
 import {
   FileSys2
 } from "./index-52w0fvh8.js";
 import {
   PkgExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
   TypeScriptDependencyScanner2
 } from "./index-2ahj896a.js";

package/{index-ae5pwhgs.js → index-r5d6rq19.js}

@@ -1,13 +1,13 @@
 // @bun
 import {
   AppExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
   jsonText,
   createWorkflowBaselineSummary,
   buildAkanModuleContextIndex,
   toolingRolloutGate
-} from "./index-05g3jayg.js";
+} from "./index-wdze51wz.js";
 import {
   buildResourceList,
   codexMcpConfigPath,
@@ -17,23 +17,25 @@ import {
   upsertCodexMcpServerBlock,
   renderDoctorText,
   AkanContextAnalyzer
-} from "./index-2mx692qq.js";
+} from "./index-vhfjzda3.js";
 import {
   runner
-} from "./index-6jjtnhkw.js";
+} from "./index-3x7yeecy.js";
 import {
-  NativeApp,
   isPlaceholderAppId
-} from "./index-1w2qaee2.js";
+} from "./index-kmamh5bv.js";
+import {
+  NativeApp
+} from "./index-qf8g88j9.js";
 import {
   Prompter2
 } from "./index-zzvvc845.js";
 import {
   RepairRunner
-} from "./index-fm46xrf1.js";
+} from "./index-q5abh0jq.js";
 import {
   WorkflowRunner
-} from "./index-rwq3ekqc.js";
+} from "./index-xf40a295.js";
 import {
   getMobileTargets,
   appIdsOf

package/{index-2mx692qq.js → index-vhfjzda3.js}

@@ -10,7 +10,7 @@ import {
   isScannedRootEntry,
   AppExecutor,
   LibExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
   FileSys2
 } from "./index-52w0fvh8.js";
@@ -23,7 +23,7 @@ import {
   workflowPathsForPlan,
   workflowRunArtifactPath,
   workflowSyncDir
-} from "./index-05g3jayg.js";
+} from "./index-wdze51wz.js";
 
 // pkgs/@akanjs/devkit/akanContext.ts
 import { readdir } from "fs/promises";

package/{index-8r4d7cmt.js → index-w9b71b6y.js}

@@ -1,16 +1,16 @@
 // @bun
 import {
   jsonText
-} from "./index-05g3jayg.js";
+} from "./index-wdze51wz.js";
 import {
   akanMcpInstallTargets
-} from "./index-2mx692qq.js";
+} from "./index-vhfjzda3.js";
 import {
   script
-} from "./index-6jjtnhkw.js";
+} from "./index-3x7yeecy.js";
 import {
   ContextRunner2
-} from "./index-ae5pwhgs.js";
+} from "./index-r5d6rq19.js";
 
 // pkgs/@akanjs/cli/context/context.script.ts
 import { Logger } from "akanjs/common";

package/{index-8ggztp8k.js → index-wanhh011.js}

@@ -3,24 +3,20 @@ import {
   getDefaultHostConfig,
   GlobalConfig,
   CloudApi,
-  UpdatePackUpload
-} from "./index-pgj2rt78.js";
-import {
-  runner
-} from "./index-6jjtnhkw.js";
+  CloudUpdates,
+  PipelineSecrets
+} from "./index-wjqbc7sf.js";
 import {
   WorkspaceExecutor,
   AppExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 import {
-  NativeApp
-} from "./index-1w2qaee2.js";
+  runner,
+  assertPromptable
+} from "./index-3x7yeecy.js";
 import {
   SubspaceConfig
-} from "./index-ww9bhp67.js";
-import {
-  resolveMobileTargets
-} from "./index-q958tqqg.js";
+} from "./index-4pf8g7ff.js";
 import {
   openBrowser
 } from "./index-9dp031by.js";
@@ -657,11 +653,9 @@ class PlatformTestRun {
 }
 
 // pkgs/@akanjs/cli/cloud/cloud.runner.ts
-import { rm } from "fs/promises";
-import os3 from "os";
 import path7 from "path";
-import { confirm, input, password, select } from "@inquirer/prompts";
-import { Logger, PipelineNames, sleep } from "akanjs/common";
+import { confirm, input, select } from "@inquirer/prompts";
+import { Logger, sleep } from "akanjs/common";
 import chalk2 from "chalk";
 import * as QRcode from "qrcode";
 
@@ -766,6 +760,9 @@ class CloudRunner extends runner("cloud") {
     return { name: `${name} (${this.#getSshTarget(config)}${config.port ? `:${config.port}` : ""})`, value: name };
   }
   async#getRemoteEnvServerWithUsername() {
+    assertPromptable("The env archive goes over scp to a remote server picked here, as AKAN_WORKSPACE_ID is not set", {
+      remedy: "set AKAN_WORKSPACE_ID in the workspace .env to use Akan Cloud, or run it once in a terminal"
+    });
     const remoteServer = await this.#selectRemoteEnvServer();
     if (remoteServer.config.username)
       return remoteServer;
@@ -891,6 +888,9 @@ ${run.format(results)}
       const reason = result.infraError ?? "failing tests";
       if (!interactive)
         continue;
+      assertPromptable(`${result.platform} did not pass (${reason}) \u2014 ${run.logDir}`, {
+        remedy: "leave it out of --platforms to publish without it, or run it in a terminal to be asked"
+      });
       const proceed = await confirm({
         message: `${result.platform} did not pass (${reason}). Continue without it?`,
         default: false
@@ -909,6 +909,9 @@ ${run.format(results)}
     return results;
   }
   async#askWindowsTestTarget() {
+    assertPromptable("No Windows test target is configured", {
+      remedy: "run it once in a terminal, which saves the target to ~/.akan/config.json"
+    });
     Logger.info("No Windows test target is configured yet; it is saved to ~/.akan/config.json once entered.");
     const required = (value) => !!value.trim();
     const host = await this.#ask("Windows host (ip or name): ", required);
@@ -944,11 +947,15 @@ ${run.format(results)}
     for (const library of akanPkgs) {
       const packageJson = await workspace.readJson(`pkgs/${library}/package.json`);
       const newPackageJson = this.#normalizeAkanPackageJson(packageJson, library, nextVersion);
-      await workspace.writeFile(`pkgs/${library}/package.json`, JSON.stringify(newPackageJson, null, 2));
+      await workspace.writeJson(`pkgs/${library}/package.json`, newPackageJson);
       const distPackageJson = await workspace.readJson(`dist/pkgs/${library}/package.json`);
       const newDistPackageJson = this.#normalizeAkanPackageJson(distPackageJson, library, nextVersion);
       await workspace.writeJson(`dist/pkgs/${library}/package.json`, newDistPackageJson);
     }
+    if (confirmPublish)
+      assertPromptable(`Publishing ${akanPkgs.join(", ")}@${nextVersion} asks for a confirmation`, {
+        remedy: "run it in a terminal"
+      });
     if (confirmPublish && !await confirm({ message: "Are you sure you want to deploy the libraries?" })) {
       Logger.error("Deployment cancelled");
       return;
@@ -1014,7 +1021,7 @@ ${run.format(results)}
   async downloadEnv(cloudApi, workspace, workspaceId) {
     await workspace.mkdir("local");
     const localPath = await cloudApi.downloadEnv(workspaceId).catch((error) => {
-      throw CloudRunner.#refusal(error, "downloading its env archive takes the project owner's own `akan login`");
+      throw CloudApi.refusal(error, "downloading its env archive takes the project owner's own `akan login`");
     });
     const relativePath = path7.relative(workspace.workspaceRoot, localPath).split(path7.sep).join("/");
     await workspace.spawn("tar", ["-xf", relativePath], { cwd: workspace.workspaceRoot });
@@ -1023,7 +1030,7 @@ ${run.format(results)}
   async uploadEnv(cloudApi, workspaceId, filePath) {
     const file = new File([Bun.file(filePath)], path7.basename(filePath));
     await cloudApi.uploadEnv(workspaceId, file).catch((error) => {
-      throw CloudRunner.#refusal(error, "an env archive is uploaded by a project member signed in with `akan login`");
+      throw CloudApi.refusal(error, "an env archive is uploaded by a project member signed in with `akan login`");
     });
   }
   async downloadEnvByScp(workspace) {
@@ -1096,7 +1103,7 @@ ${run.format(results)}
     }));
     return secretPaths.flat();
   }
-  async secretProject(workspace, subspace) {
+  async projectOf(workspace, subspace, appName) {
     if (!subspace) {
       const workspaceId = workspace.getWorkspaceId({ allowEmpty: true });
       if (!workspaceId)
@@ -1109,172 +1116,30 @@ ${run.format(results)}
     const [declaration] = config.select([subspace]);
     if (!declaration?.workspaceId)
       throw new Error(`Subspace "${subspace}" declares no workspaceId in ${SubspaceConfig.source}.`);
+    if (appName && !declaration.apps.includes(appName))
+      throw new Error(`Subspace "${subspace}" declares no app ${appName} in ${SubspaceConfig.source}; it serves ${declaration.apps.join(", ")}.`);
     return declaration.workspaceId;
   }
   async readSecretValue(name, file) {
-    const raw = file ? await Bun.file(file).text() : process.stdin.isTTY ? await password({ message: `Value of ${name} (hidden; it can never be read back)`, mask: "*" }) : await Bun.stdin.text();
-    const value = raw.replace(/\r?\n$/, "");
-    if (!value)
-      throw new Error(`The value of ${name} is empty.`);
-    const bytes = new TextEncoder().encode(value).length;
-    if (bytes > CloudRunner.#secretBytes)
-      throw new Error(`The value of ${name} is ${bytes} bytes, over ${CloudRunner.#secretBytes}.`);
-    return value;
-  }
-  async uploadSecret(cloudApi, devProjectId, { name, branch, value }) {
-    CloudRunner.#assertSecretName(name);
-    CloudRunner.#assertSecretBranch(branch);
-    const saved = await cloudApi.uploadSecret(devProjectId, { scope: branch ?? "*", name, value }).catch((error) => {
-      throw CloudRunner.#refusal(error, "a secret is written by a project member signed in with `akan login`", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    Logger.rawLog(`Saved ${saved.name} for ${saved.scope === "*" ? "every branch" : `branch ${saved.scope}`}. Builds that start from now on use it.`);
+    return await PipelineSecrets.readValue(name, file);
+  }
+  async uploadSecret(cloudApi, devProjectId, secret) {
+    await new PipelineSecrets(cloudApi, devProjectId).upload(secret);
   }
   async listSecrets(cloudApi, devProjectId, branch) {
-    CloudRunner.#assertSecretBranch(branch);
-    const listed = await cloudApi.listSecrets(devProjectId).catch((error) => {
-      throw CloudRunner.#refusal(error, "the secrets are listed for a project member", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    const secrets = listed.filter((secret) => !branch || secret.scope === "*" || secret.scope === branch);
-    Logger.rawLog(CloudRunner.formatSecrets(secrets));
-  }
-  async removeSecret(cloudApi, devProjectId, { name, branch }) {
-    CloudRunner.#assertSecretName(name);
-    CloudRunner.#assertSecretBranch(branch);
-    const removed = await cloudApi.removeSecret(devProjectId, { scope: branch ?? "*", name }).catch((error) => {
-      throw CloudRunner.#refusal(error, "a secret is removed by a project member signed in with `akan login`", {
-        unavailable: CloudRunner.#secretsUnavailable
-      });
-    });
-    Logger.rawLog(removed ? `Removed ${name} for ${branch ? `branch ${branch}` : "every branch"}.` : `No ${name} for ${branch ? `branch ${branch}` : "every branch"} to remove.`);
-  }
-  static #packRecords = ["manifest.template.json", "bundle.json", "pack.json", "compat.json"];
-  static async#tarPack(pack) {
-    const templateFile = Bun.file(path7.join(pack.out, "manifest.template.json"));
-    if (!await templateFile.exists())
-      throw new Error(`${pack.out} holds no manifest.template.json: give the folder \`akan pack-update\` wrote.`);
-    const template = await templateFile.json();
-    const hashes = new Set((template.files ?? []).map((file) => file.sha256));
-    if (![...hashes].every((hash) => typeof hash === "string" && /^[0-9a-f]{64}$/.test(hash)))
-      throw new Error(`${pack.out}/manifest.template.json lists a file whose sha256 is not 64 hex digits.`);
-    const present = await Promise.all(CloudRunner.#packRecords.map((name) => Bun.file(path7.join(pack.out, name)).exists()));
-    const entries = [
-      ...CloudRunner.#packRecords.filter((_, idx) => present[idx]),
-      ...[...hashes].map((hash) => `files/${hash}`)
-    ];
-    const base = path7.join(os3.tmpdir(), `akan-pack-${pack.app}-${pack.target}-${pack.platform}-${process.pid}`);
-    await Bun.write(`${base}.list`, entries.map((entry) => `./${entry}
-`).join(""));
-    try {
-      const tar = Bun.spawn(["tar", "-czf", `${base}.tgz`, "-C", pack.out, "-T", `${base}.list`], {
-        stdout: "ignore",
-        stderr: "pipe"
-      });
-      if (await tar.exited !== 0)
-        throw new Error(`tar of ${pack.out} failed: ${(await new Response(tar.stderr).text()).trim()}`);
-    } finally {
-      await rm(`${base}.list`, { force: true });
-    }
-    return `${base}.tgz`;
+    await new PipelineSecrets(cloudApi, devProjectId).list(branch);
   }
-  async pushUpdate(cloudApi, devProjectId, pack, { channel, notes }) {
-    const archive = await CloudRunner.#tarPack(pack);
-    const target = channel ?? pack.channel;
-    try {
-      const release = await new UpdatePackUpload(cloudApi, devProjectId).send(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel: target, notes }).catch((error) => {
-        throw CloudRunner.#refusal(error, "a pack is uploaded by a project member signed in with `akan login`");
-      });
-      const label = `${pack.app} ${pack.target} ${pack.platform} on channel ${target}: release ${release.id}`;
-      if (release.status === "rejected") {
-        process.exitCode = 2;
-        Logger.error(`The project rejected ${label}:
-${(release.problems ?? []).map((problem) => `  - ${problem}`).join(`
-`)}`);
-      } else if (release.status === "published")
-        Logger.rawLog(`Published ${label} (${pack.files} files, native API ${pack.nativeApi}).`);
-      else
-        Logger.rawLog(`Staged ${label} (${pack.files} files, native API ${pack.nativeApi}). Publish it from the project's release screen.`);
-      return release;
-    } finally {
-      await rm(archive, { force: true });
-    }
+  async removeSecret(cloudApi, devProjectId, secret) {
+    await new PipelineSecrets(cloudApi, devProjectId).remove(secret);
   }
-  async registerBinary(cloudApi, devProjectId, app, pack, { distribution, env }) {
-    const [mobileTarget] = await resolveMobileTargets(app, pack.target);
-    if (!mobileTarget)
-      throw new Error(`Native target '${pack.target}' was not found.`);
-    const bundlePath = path7.join(new NativeApp(app, mobileTarget).outDir(pack.platform), "bundle.json");
-    const bundleFile = Bun.file(bundlePath);
-    if (!await bundleFile.exists())
-      throw new Error(`No store build at ${bundlePath}: run \`akan release-${pack.platform} ${app.name} --target ${pack.target} --env ${env}\` first.`);
-    const bundle = await bundleFile.json();
-    if (!bundle.updates)
-      throw new Error(`The store build at ${bundlePath} takes no updates: give the target native.updates.`);
-    if (bundle.nativeApi?.hash !== pack.nativeApi)
-      throw new Error(`The store build at ${bundlePath} provides native API ${bundle.nativeApi?.hash}, and this commit's pack needs ${pack.nativeApi}: build the store binary from this commit.`);
-    const archive = await CloudRunner.#tarPack(pack);
-    const channel = bundle.updates.channel ?? pack.channel;
-    const upload = new UpdatePackUpload(cloudApi, devProjectId);
-    try {
-      const binary = await upload.stage(archive, { appName: pack.app, target: pack.target, platform: pack.platform, channel, notes: null }).then((packUploadId) => upload.settle(() => cloudApi.registerAppBinary(devProjectId, {
-        appName: pack.app,
-        target: pack.target,
-        distribution,
-        bundle: bundleFile,
-        packUploadId,
-        channel
-      }))).catch((error) => {
-        throw CloudRunner.#refusal(error, "a binary is registered by a project member signed in with `akan login`");
-      });
-      Logger.rawLog(`Registered ${pack.app} ${pack.target} ${pack.platform} (${distribution}): binary ${binary.id}, native API ${pack.nativeApi}.`);
-      return binary;
-    } finally {
-      await rm(archive, { force: true });
-    }
+  async readPack(app, dir, flags) {
+    return await CloudUpdates.readPack(app, dir, flags);
   }
-  static formatSecrets(secrets) {
-    if (!secrets.length)
-      return "No pipeline secrets.";
-    const rows = [...secrets].sort((a, b) => a.name.localeCompare(b.name) || a.scope.localeCompare(b.scope)).map((secret) => [
-      secret.name,
-      secret.scope === "*" ? "every branch" : secret.scope,
-      secret.updatedAt,
-      secret.updatedBy
-    ]);
-    const header = ["NAME", "SCOPE", "UPDATED", "BY"];
-    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => row[column]?.length ?? 0)));
-    return [header, ...rows].map((row) => row.map((cell, column) => cell.padEnd(widths[column] ?? 0)).join("  ").trimEnd()).join(`
-`);
+  async pushUpdate(cloudApi, devProjectId, pack, options) {
+    return await new CloudUpdates(cloudApi, devProjectId).push(pack, options);
   }
-  static #secretBytes = 64 * 1024;
-  static #secretBranches = ["debug", "develop", "main"];
-  static #secretsUnavailable = "The server is not configured for pipeline secrets yet.";
-  static #assertSecretName(name) {
-    const problem = PipelineNames.secretNameError(name);
-    if (problem)
-      throw new Error(problem);
-  }
-  static #assertSecretBranch(branch) {
-    if (branch !== null && !CloudRunner.#secretBranches.includes(branch))
-      throw new Error(`--branch ${branch} is not a deployed branch: ${CloudRunner.#secretBranches.join(", ")}.`);
-  }
-  static #refusal(error, who, { unavailable } = {}) {
-    const message = error instanceof Error ? error.message : String(error);
-    const status = CloudApi.statusOf(error);
-    if (status === 401)
-      return new Error("The server did not accept your sign-in: run `akan login`, then try again.");
-    if (status === 403)
-      return new Error(`The project refused: ${who}.`);
-    if (status === 400) {
-      const key = /"error"\s*:\s*"([^"]+)"/.exec(message)?.[1];
-      return new Error(`The project refused the request${key ? `: ${key}` : ""}.`);
-    }
-    if (status === 503 && unavailable)
-      return new Error(unavailable);
-    return error;
+  async registerBinary(cloudApi, devProjectId, app, pack, options) {
+    return await new CloudUpdates(cloudApi, devProjectId).registerBinary(app, pack, options);
   }
   async#syncSecretGitignore(workspace, appNames) {
     const patterns = (await Promise.all(appNames.map(async (appName) => {

package/{index-05g3jayg.js → index-wdze51wz.js}

@@ -2,7 +2,7 @@
 import {
   AppExecutor,
   LibExecutor
-} from "./index-55mynnqs.js";
+} from "./index-bv210r6t.js";
 
 // pkgs/@akanjs/devkit/workflow/utils.ts
 var jsonText = (value, { trailingNewline = true } = {}) => `${JSON.stringify(value, null, 2)}${trailingNewline ? `