@akterjs/cli 0.0.0-stage → 0.1.1

package/dist/credentials/login.config.mjs

@@ -0,0 +1,251 @@
+import { t as match } from "../Boolean-kILIvmhE.mjs";
+import { n as log } from "../Console-BKHUkH6a.mjs";
+import { C as catch_, M as fail, U as fn, W as fnUntraced, et as gen, gn as void_, ht as mapError, in as timeout, l as as } from "../Effect-CKFpqbmw.mjs";
+import { S as none, _ as isSome, f as getOrElse, h as isNone, p as getOrNull, v as liftPredicate, w as some, x as match$1 } from "../Option-DkxSnBhp.mjs";
+import { i as value, n as make } from "../Redacted-RkJrG5Me.mjs";
+import { B as TaggedStruct, F as String, I as Struct, S as Literals, mt as is, ot as decodeUnknownOption } from "../Schema-MiKt5K1v.mjs";
+import { t as Stdio } from "../Stdio-KylmOBX_.mjs";
+import { M as mkString, i as decodeText } from "../Stream-bK9QIETN.mjs";
+import { o as isEmpty, v as trim } from "../String-q5dcsVe4.mjs";
+import { f as optional, i as withDescription$1, l as String$1, m as withDescription, o as Boolean, p as withDefault, t as make$1 } from "../Command-Dzq9KM-h.mjs";
+import { c as String$2, d as run, o as Password, t as TerminalCapabilities } from "../TerminalCapabilities-w_44MAca.mjs";
+import { CliExitError } from "../terminal/cli-exit.errors.mjs";
+import { Confirmation } from "../terminal/confirm.adapter.mjs";
+import { Credentials } from "./credentials.service.mjs";
+import { t as CloudClient } from "../cloud-client.adapter-DOVMoYAj.mjs";
+import { compactJson } from "../registry/operation-output.pure.mjs";
+// src/credentials/login.config.ts
+const json = Boolean("json").pipe(withDefault(false), withDescription("Print the result as one line of JSON"));
+const usage = (reason, message) => CliExitError.make({
+	code: CliExitError.codes.usage,
+	message,
+	reason
+});
+const noKey = () => usage("MissingApiKey", "akter login --with-api-key reads the API key from stdin, and stdin was empty.");
+const readKey = gen(function* readKey() {
+	const { canPrompt } = yield* TerminalCapabilities;
+	if (canPrompt) return yield* run(Password({ message: "API key" })).pipe(mapError(noKey));
+	const stdio = yield* Stdio;
+	const text = yield* mkString(decodeText(stdio.stdin)).pipe(mapError(noKey));
+	return make(trim(text));
+});
+const refused = (origin) => (failure) => CliExitError.make({
+	code: failure.code,
+	message: `${failure.message} (${origin}); nothing was saved.`,
+	reason: failure.reason
+});
+const verified = fnUntraced(function* verified(secret, url) {
+	const cloud = yield* CloudClient.use((factory) => factory.connect({
+		apiKey: secret,
+		url
+	}));
+	return yield* mapError(cloud.signIn, refused(url.origin));
+});
+const whereOf = (saved) => match(saved.store === "keychain", {
+	onFalse: () => `${saved.file}, readable only by you, because no OS keychain was reachable`,
+	onTrue: () => "the OS keychain"
+});
+const report = fnUntraced(function* report(saved, url, options) {
+	if (options.json) {
+		const organization = getOrNull(options.organization);
+		const text = yield* compactJson({
+			file: saved.file,
+			organization,
+			store: saved.store,
+			url: url.href
+		});
+		return yield* log(text);
+	}
+	return yield* log(`Signed in to ${url.origin}. The key is saved in ${whereOf(saved)}.`);
+});
+const keyLogin = fn("keyLogin")(function* keyLogin(options) {
+	const credentials = yield* Credentials;
+	const url = yield* credentials.url(options.url);
+	const secret = yield* readKey;
+	if (isEmpty(value(secret))) return yield* noKey();
+	yield* verified(secret, url);
+	const saved = yield* credentials.save({
+		organization: options.organization,
+		secret,
+		url
+	});
+	return yield* report(saved, url, options);
+});
+const signInWait = "30 seconds";
+const codeReasons = {
+	expired: "The code expired. Run akter login again for a new one.",
+	invalid: "The code is wrong, expired, already used, or replaced by a newer one. Run akter login again for a new one.",
+	tooManyAttempts: "The code took too many wrong guesses and no longer works. Run akter login again for a new one."
+};
+const Rejected = TaggedStruct("SignInVerifyCode401", { cause: Struct({ reason: Literals([
+	"expired",
+	"invalid",
+	"tooManyAttempts"
+]) }) });
+const TermsRefused = TaggedStruct("SignInVerifyCode422", { cause: Struct({ version: String }) });
+const termsUnread = (version) => `Creating an account needs you to accept Akter's terms of service and privacy notice, version ${version}. Read them with akter docs legal/terms and akter docs legal/privacy, then run this again with --accept-terms and the same --code; the code still works.`;
+const termsNotAccepted = (version) => CliExitError.make({
+	code: CliExitError.codes.confirmation,
+	message: termsUnread(version),
+	reason: "TermsNotAccepted"
+});
+const signInFailure = (origin) => (failure) => match$1(decodeUnknownOption(Rejected)(failure), {
+	onNone: () => match$1(decodeUnknownOption(TermsRefused)(failure), {
+		onNone: () => CliExitError.make({
+			code: CliExitError.codes.unavailable,
+			message: `${origin} didn't answer the sign-in, or asked to wait before another code; nothing was saved.`,
+			reason: "SignInUnavailable"
+		}),
+		onSome: ({ cause }) => termsNotAccepted(cause.version)
+	}),
+	onSome: ({ cause }) => CliExitError.make({
+		code: CliExitError.codes.authentication,
+		message: codeReasons[cause.reason],
+		reason: "CodeRejected"
+	})
+});
+const noEmail = () => usage("MissingEmail", "Pass --email: akter login emails a sign-in code there, then takes it with --code.");
+const emailOf = fnUntraced(function* emailOf(given) {
+	if (isSome(given)) return given.value;
+	const { canPrompt } = yield* TerminalCapabilities;
+	if (!canPrompt) return yield* noEmail();
+	return yield* run(String$2({ message: "Email" })).pipe(mapError(noEmail));
+});
+const printSent = fnUntraced(function* printSent(sent, asJson) {
+	if (asJson) {
+		const text = yield* compactJson({
+			codeSent: true,
+			email: sent.email,
+			expiresAt: sent.expiresAt
+		});
+		return yield* log(text);
+	}
+	return yield* log(`Sent a sign-in code to ${sent.email}; it works until ${sent.expiresAt}. Finish with: akter login --email ${sent.email} --code <code>`);
+});
+const codeOf = fnUntraced(function* codeOf({ client, email, options, origin }) {
+	if (isSome(options.code)) return options.code;
+	const sent = yield* client.signInSendCode({ payload: { email } }).pipe(timeout(signInWait), mapError(signInFailure(origin)));
+	const { canPrompt } = yield* TerminalCapabilities;
+	if (!canPrompt) return yield* as(printSent(sent, options.json), none());
+	const typed = yield* run(String$2({ message: `The code emailed to ${sent.email}` }));
+	return some(trim(typed));
+});
+const acceptTerms = fnUntraced(function* acceptTerms(version, given) {
+	if (given) return true;
+	return yield* Confirmation.use((confirmation) => confirmation.confirm({
+		question: `Creating your account accepts Akter's terms of service and privacy notice, version ${version} (read them with akter docs legal/terms and akter docs legal/privacy). Accept them?`,
+		unattended: termsUnread(version)
+	}));
+});
+const verifyCode = fnUntraced(function* verifyCode({ client, code, email, options, origin }) {
+	const send = fnUntraced(function* send(acceptedTerms) {
+		const terms = match$1(acceptedTerms, {
+			onNone: () => ({}),
+			onSome: (version) => ({ acceptedTerms: version })
+		});
+		return yield* client.signInVerifyCode({ payload: {
+			code,
+			email,
+			...terms
+		} }).pipe(timeout(signInWait));
+	});
+	const accepted = fnUntraced(function* accepted(failure) {
+		const terms = decodeUnknownOption(TermsRefused)(failure);
+		if (isNone(terms)) return yield* fail(failure);
+		yield* acceptTerms(terms.value.cause.version, options.acceptTerms);
+		return yield* send(some(terms.value.cause.version));
+	});
+	return yield* send(none()).pipe(catch_(accepted), mapError((failure) => getOrElse(liftPredicate(failure, is(CliExitError)), () => signInFailure(origin)(failure))));
+});
+const reportSession = fnUntraced(function* reportSession({ asJson, saved, signedIn, url }) {
+	const { account, created, session } = signedIn;
+	if (asJson) {
+		const text = yield* compactJson({
+			account,
+			created,
+			file: saved.file,
+			session,
+			store: saved.store,
+			url: url.href
+		});
+		return yield* log(text);
+	}
+	const done = match(created, {
+		onFalse: () => "Signed in",
+		onTrue: () => "Created your account and signed in"
+	});
+	return yield* log(`${done} to ${url.origin} as ${account.email}. The session is saved in ${whereOf(saved)}.`);
+});
+const emailLogin = fn("emailLogin")(function* emailLogin(options) {
+	const credentials = yield* Credentials;
+	const url = yield* credentials.url(options.url);
+	const client = yield* CloudClient.use((factory) => factory.anonymous(url));
+	const email = yield* emailOf(options.email);
+	const code = yield* codeOf({
+		client,
+		email,
+		options,
+		origin: url.origin
+	});
+	if (isNone(code)) return yield* void_;
+	const signedIn = yield* verifyCode({
+		client,
+		code: code.value,
+		email,
+		options,
+		origin: url.origin
+	});
+	const saved = yield* credentials.save({
+		organization: options.organization,
+		secret: make(signedIn.secret),
+		url
+	});
+	return yield* reportSession({
+		asJson: options.json,
+		saved,
+		signedIn,
+		url
+	});
+});
+const saveLogin = fn("saveLogin")(function* saveLogin(options) {
+	if (options.withApiKey) return yield* keyLogin(options);
+	return yield* emailLogin(options);
+});
+const forget = fn("forget")(function* forget(options) {
+	const removed = yield* Credentials.use((credentials) => credentials.clear);
+	if (options.json) {
+		const text = yield* compactJson({ removed });
+		return yield* log(text);
+	}
+	return yield* log(match(removed, {
+		onFalse: () => "There was no saved login.",
+		onTrue: () => "Signed out; the saved login is removed."
+	}));
+});
+const organization = String$1("organization").pipe(optional, withDescription("The organization later commands use when they get no --organization"));
+const url = String$1("url").pipe(optional, withDescription("The Cloud API's URL; defaults to AKTER_CLOUD_URL, then https://api.akter.dev"));
+const email = String$1("email").pipe(optional, withDescription("Email a sign-in code to this address; prompted for when a person is at the terminal"));
+const code = String$1("code").pipe(optional, withDescription("The six-digit code from the email; without one, a code is emailed and, with no terminal, the run ends"));
+const acceptTermsFlag = Boolean("accept-terms").pipe(withDefault(false), withDescription("Accept Akter's terms of service and privacy notice (akter docs legal/terms, legal/privacy) if this code creates an account, without asking"));
+const login = make$1("login", {
+	acceptTerms: acceptTermsFlag,
+	code,
+	email,
+	json,
+	organization,
+	url,
+	withApiKey: Boolean("with-api-key").pipe(withDefault(false), withDescription("Read an API key or agent key from stdin instead, check it with the API and save it"))
+}, saveLogin).pipe(withDescription$1("Sign in with a code emailed to you, or an API key, and save the session in the OS keychain or a file only you can read"));
+const signup = make$1("signup", {
+	acceptTerms: acceptTermsFlag,
+	code,
+	email,
+	json,
+	organization,
+	url
+}, (options) => emailLogin({
+	...options,
+	withApiKey: false
+})).pipe(withDescription$1("Create an Akter account with a code emailed to you, and save its session"));
+const logout = make$1("logout", { json }, forget).pipe(withDescription$1("Remove the saved login; AKTER_API_KEY is unaffected"));
+export { login, logout, signup };

package/dist/deploy/auth/api-attempt.service.mjs

@@ -0,0 +1,30 @@
+import { B as flatMap, Jt as serviceOption, Lt as retry, W as fnUntraced, aa as Service, gn as void_, in as timeout, jt as provideService, o as andThen, ti as isTimeoutError, y as catchIf } from "../../Effect-CKFpqbmw.mjs";
+import { t as error } from "../../Console-BKHUkH6a.mjs";
+import { x as match } from "../../Option-DkxSnBhp.mjs";
+import { o as set, r as make, t as get } from "../../Ref-BIPOxJNH.mjs";
+import { mt as is } from "../../Schema-MiKt5K1v.mjs";
+import { TokenRefreshError } from "./token-refresh.errors.mjs";
+import { reconnectBackoff, refreshMessage, requestFailure } from "../request-failure.pure.mjs";
+// src/deploy/auth/api-attempt.service.ts
+const isRefresh = is(TokenRefreshError);
+const timedOut = fnUntraced(function* timedOut(phase, failure) {
+	const current = yield* get(phase);
+	if (current === "refresh") return yield* TokenRefreshError.make({ message: refreshMessage(failure) });
+	if (current === "initial") return yield* requestFailure("API key exchange")(failure);
+	return yield* failure;
+});
+var ApiAttempt = class ApiAttempt extends Service()("@akterjs/cli/deploy/auth/api-attempt.service/ApiAttempt") {
+	static mark = (phase) => flatMap(serviceOption(ApiAttempt), match({
+		onNone: () => void_,
+		onSome: (state) => set(state, phase)
+	}));
+	static request = fnUntraced(function* request(action, wait) {
+		const phase = yield* make("request");
+		const attempt = andThen(set(phase, "request"), action).pipe(timeout(wait), catchIf(isTimeoutError, (failure) => timedOut(phase, failure)), provideService(ApiAttempt, phase));
+		return yield* attempt.pipe(catchIf(isRefresh, (failure) => error(`${failure.message} Retrying; the request will resume after authentication recovers.`).pipe(andThen(retry(attempt, {
+			schedule: reconnectBackoff,
+			while: isRefresh
+		})))));
+	});
+};
+export { ApiAttempt };

package/dist/deploy/auth/token-refresh.errors.mjs

@@ -0,0 +1,4 @@
+import { F as String, z as TaggedError } from "../../Schema-MiKt5K1v.mjs";
+// src/deploy/auth/token-refresh.errors.ts
+var TokenRefreshError = class extends TaggedError()("TokenRefreshError", { message: String }) {};
+export { TokenRefreshError };

package/dist/deploy/build-bundle.adapter.mjs

@@ -0,0 +1,133 @@
+import { M as match, W as unfold, j as map } from "../Array-B4kuTQeW.mjs";
+import { At as provideContext, B as flatMap, Q as fromOption, T as context, U as fn, Vn as effect, W as fnUntraced, _a as pick, aa as Service, cn as tryPromise, dt as map$1, et as gen, z as findFirst } from "../Effect-CKFpqbmw.mjs";
+import { t as FileSystem } from "../FileSystem-4pPcEb_i.mjs";
+import { b as map$2, f as getOrElse, i as filter, u as fromNullishOr, w as some } from "../Option-DkxSnBhp.mjs";
+import { t as Path } from "../Path-Djdv_eF5.mjs";
+import { F as String, I as Struct, n as ArraySchema, pt as fromJsonString, st as encodeEffect, tt as decodeEffect, v as Int } from "../Schema-MiKt5K1v.mjs";
+import { i as sha256, t as Digest } from "../Digest-CBd3uv5B.mjs";
+import { a as ChildProcessSpawner, n as make } from "../ChildProcess-BCIwxPGc.mjs";
+import { i as hostInterfaceLine } from "../hosted-runtime.layer-Cx3IPsEd.mjs";
+import { n as BuildManifest } from "../cloud-client.adapter-Cy1BjDbG.mjs";
+import { manifestRunner } from "./build-manifest.pure.mjs";
+import { DeployFailedError } from "./deploy-failed.errors.mjs";
+import { build } from "esbuild";
+// src/deploy/build-bundle.adapter.ts
+const firstOutput = 0;
+const successfulExit = 0;
+const decodeManifest = decodeEffect(fromJsonString(BuildManifest));
+/** Each actor's host interface version, which build.json carries beside the manifest Akter Cloud's API takes. */
+const HostInterfaces = Struct({ actors: ArraySchema(Struct({ hostInterface: Int })) });
+const decodeVersions = decodeEffect(fromJsonString(HostInterfaces));
+const unnamed = 0;
+/**
+* The bundle with its host interface version as its first line: the oldest any of its actors was built with, which is
+* the app's own akter, so the control plane reads it from the stored bundle. An app without actors names 0.
+*/
+const marked = (text, contents) => map$1(decodeVersions(text), ({ actors }) => {
+	const oldest = match(map(actors, (actor) => actor.hostInterface), {
+		onEmpty: () => unnamed,
+		onNonEmpty: (versions) => Math.min(...versions)
+	});
+	const line = new globalThis.TextEncoder().encode(hostInterfaceLine(oldest));
+	return Uint8Array.from([...line, ...contents]);
+});
+const compileApp = fn("compileApp")(function* compileApp(entry) {
+	const compiled = yield* tryPromise({
+		catch: () => DeployFailedError.make({ message: "Could not bundle the app. Check its entry and imports." }),
+		try: () => build({
+			banner: { js: "import { createRequire as __akterCreateRequire } from \"node:module\"; const require = __akterCreateRequire(import.meta.url);" },
+			bundle: true,
+			conditions: ["@akterjs/source"],
+			entryPoints: [entry],
+			format: "esm",
+			logLevel: "silent",
+			platform: "node",
+			target: "esnext",
+			write: false
+		})
+	});
+	return yield* fromOption(fromNullishOr(compiled.outputFiles.at(firstOutput)), () => DeployFailedError.make({ message: "The app build produced no JavaScript." }));
+});
+const writeRunner = fn("writeRunner")(function* writeRunner(files) {
+	const fs = yield* FileSystem;
+	const url = yield* (yield* Path).toFileUrl(files.bundle);
+	const quote = encodeEffect(fromJsonString(String));
+	const entry = yield* quote(url.href);
+	const output = yield* quote(files.manifest);
+	yield* fs.writeFileString(files.runner, manifestRunner({
+		entry,
+		output
+	}));
+});
+const describeApp = fn("describeApp")(function* describeApp(folder, bundle) {
+	const fs = yield* FileSystem;
+	const path = yield* Path;
+	const spawner = yield* ChildProcessSpawner;
+	const files = {
+		bundle: path.resolve(folder, "app.mjs"),
+		manifest: path.resolve(folder, "build.json"),
+		runner: path.resolve(folder, "manifest.mjs")
+	};
+	yield* fs.writeFile(files.bundle, bundle);
+	yield* writeRunner(files);
+	if ((yield* spawner.exitCode(make(globalThis.process.execPath, [files.runner], {
+		env: { AKTER_API_KEY: "" },
+		extendEnv: true,
+		stderr: "ignore",
+		stdout: "ignore"
+	}))) !== successfulExit) return yield* DeployFailedError.make({ message: "Could not read the app's contract and migration metadata." });
+	return yield* flatMap(fs.readFileString(files.manifest), (text) => map$1(decodeManifest(text), (manifest) => ({
+		manifest,
+		text
+	})));
+});
+/** The app's build.json manifest and its bundle with the host interface line its manifest names. */
+const stampedBuild = fnUntraced(function* stampedBuild(folder, contents) {
+	const described = yield* describeApp(folder, contents);
+	return {
+		bundle: yield* marked(described.text, contents),
+		manifest: described.manifest
+	};
+});
+const appRoot = fn("appRoot")(function* appRoot(entryFolder) {
+	const fs = yield* FileSystem;
+	const path = yield* Path;
+	const folders = unfold(some(entryFolder), (current) => map$2(current, (folder) => {
+		const parent = path.dirname(folder);
+		return [folder, filter(some(parent), (above) => above !== folder)];
+	}));
+	const found = yield* findFirst(folders, (folder) => fs.exists(path.join(folder, "package.json")));
+	return getOrElse(found, () => entryFolder);
+});
+const buildFolder = fn("buildFolder")(function* buildFolder(entryPath) {
+	const fs = yield* FileSystem;
+	const path = yield* Path;
+	const root = yield* appRoot(path.dirname(entryPath));
+	const modules = path.join(root, "node_modules");
+	yield* fs.makeDirectory(modules, { recursive: true });
+	return yield* fs.makeTempDirectoryScoped({
+		directory: modules,
+		prefix: ".akter-deploy-"
+	});
+});
+const bundleApp = fn("bundleApp")(function* bundleApp(entry) {
+	const fs = yield* FileSystem;
+	const entryPath = (yield* Path).resolve(entry);
+	if (!(yield* fs.exists(entryPath))) return yield* DeployFailedError.make({ message: `App entry not found: ${entry}` });
+	const folder = yield* buildFolder(entryPath);
+	const output = yield* compileApp(entryPath);
+	const { bundle, manifest } = yield* stampedBuild(folder, output.contents);
+	return {
+		bundle,
+		digest: yield* Digest.use((digest) => digest.digestHex(sha256, bundle)),
+		manifest,
+		size: bundle.byteLength
+	};
+});
+var BuildBundle = class extends Service()("@akterjs/cli/deploy/build-bundle.adapter/BuildBundle", { make: gen(function* makeBuildBundle() {
+	const context$1 = yield* context().pipe(map$1(pick(FileSystem, Path, ChildProcessSpawner, Digest)));
+	return { bundle: (entry) => provideContext(bundleApp(entry), context$1) };
+}) }) {
+	static layer = effect(this, this.make);
+};
+export { BuildBundle };

package/dist/deploy/build-manifest.pure.mjs

@@ -0,0 +1,44 @@
+// src/deploy/build-manifest.pure.ts
+const manifestRunner = ({ entry, output }) => `
+import { layer as nodeServices } from "@effect/platform-node/NodeServices"
+import { Context, Duration, Effect, FileSystem, Layer, Option, Schema } from "effect"
+import { Digest } from "effect/crypto"
+import { WorkflowEngine } from "effect/workflow"
+import { MigrationHasher } from "@akterjs/effect"
+import { ActorRegistry } from "@akterjs/effect/contract/actor-registry"
+import { renderContract } from "@akterjs/effect/contract/description"
+import { app } from ${entry}
+
+const program = Effect.gen(function* () {
+  const built = yield* Layer.build(app.layer.pipe(Layer.provideMerge(ActorRegistry.layer)))
+  const registry = Context.get(built, ActorRegistry)
+  const hasher = yield* MigrationHasher
+  const digest = yield* Digest.Digest
+  const bytes = new TextEncoder()
+  const actors = yield* Effect.forEach(app.actors, (actor) => Effect.gen(function* () {
+    const hosted = yield* registry.lookup(actor.name)
+    const contract = yield* digest.digestHex(Digest.sha256, bytes.encode(yield* renderContract(actor)))
+    const migrations = yield* Effect.forEach(
+      Object.entries(hosted.migrations).sort(([left], [right]) => Number(left) - Number(right)),
+      ([number, migration]) => Effect.map(hasher.hash(migration), (sha256) => ({ number: Number(number), sha256 })),
+    )
+    // Each query that declares staleFor, in milliseconds; an actor with none names no staleForMs, as before.
+    const staleForMs = Object.fromEntries(Object.entries(actor.queries).flatMap(([query, declared]) =>
+      Option.match(Option.flatten(Option.fromUndefinedOr(declared.staleFor)), {
+        onNone: () => [],
+        onSome: (age) => [[query, Duration.toMillis(age)]],
+      }),
+    ))
+    const ages = Object.keys(staleForMs).length > 0 ? { staleForMs } : {}
+    return { name: actor.name, contract, migrations, hostInterface: hosted.hostInterface ?? 0, ...ages }
+  }))
+  const text = yield* Schema.encodeEffect(Schema.fromJsonString(Schema.Json))({ actors })
+  yield* FileSystem.FileSystem.use((fs) => fs.writeFileString(${output}, text))
+})
+
+Effect.runPromise(program.pipe(
+  Effect.scoped,
+  Effect.provide(Layer.mergeAll(nodeServices, MigrationHasher.layer, Digest.layerWebCrypto, WorkflowEngine.layerMemory)),
+))
+`;
+export { manifestRunner };

package/dist/deploy/cloud-client.adapter.mjs

@@ -0,0 +1 @@
+export { t as CloudClient } from "../cloud-client.adapter-DOVMoYAj.mjs";

package/dist/deploy/cloud-url.pure.mjs

@@ -0,0 +1,17 @@
+import { W as fnUntraced, ht as mapError } from "../Effect-CKFpqbmw.mjs";
+import { G as URLFromString, tt as decodeEffect } from "../Schema-MiKt5K1v.mjs";
+import { DeployFailedError } from "./deploy-failed.errors.mjs";
+// src/deploy/cloud-url.pure.ts
+const defaultCloudUrl = "https://api.akter.dev";
+const cloudUrl = fnUntraced(function* cloudUrl(input) {
+	const url = yield* mapError(decodeEffect(URLFromString)(input), () => DeployFailedError.make({ message: "The Cloud API URL is invalid." }));
+	const loopback = [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(url.hostname);
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) return yield* DeployFailedError.make({ message: "Cloud API requests require HTTPS, except on loopback." });
+	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") return yield* DeployFailedError.make({ message: "The Cloud API URL must not contain credentials, a query or a fragment." });
+	return url;
+});
+export { cloudUrl, defaultCloudUrl };

package/dist/deploy/deploy-failed.errors.mjs

@@ -0,0 +1,17 @@
+import { d as fromUndefinedOr, x as match } from "../Option-DkxSnBhp.mjs";
+import { t as errorExitCode } from "../Runtime-BInIAwK3.mjs";
+import { F as String, an as optionalKey, v as Int, z as TaggedError } from "../Schema-MiKt5K1v.mjs";
+import { CliExitError } from "../terminal/cli-exit.errors.mjs";
+// src/deploy/deploy-failed.errors.ts
+var DeployFailedError = class extends TaggedError()("DeployFailedError", {
+	message: String,
+	status: optionalKey(Int)
+}) {
+	get [errorExitCode]() {
+		return match(fromUndefinedOr(this.status), {
+			onNone: () => CliExitError.codes.failed,
+			onSome: CliExitError.ofStatus
+		});
+	}
+};
+export { DeployFailedError };

package/dist/deploy/deploy.service.mjs

@@ -0,0 +1,156 @@
+import { R as some } from "../Array-B4kuTQeW.mjs";
+import { t as match } from "../Boolean-kILIvmhE.mjs";
+import { n as log, t as error } from "../Console-BKHUkH6a.mjs";
+import { At as provideContext, B as flatMap, Et as orDie, K as forEach, Kn as provide, Lt as retry, M as fail, R as filterOrFail, T as context, U as fn, Vn as effect, Wn as merge, Xt as succeed, Yt as sleep, _a as pick, aa as Service, d as asVoid, dt as map, et as gen, gn as void_, ht as mapError, ia as Reference, in as timeout, jt as provideService, o as andThen, u as asSome, y as catchIf } from "../Effect-CKFpqbmw.mjs";
+import { o as type, t as discriminatorsExhaustive } from "../Match-CGPLZYrV.mjs";
+import { b as map$1, d as fromUndefinedOr, h as isNone, nn as isNotUndefined, x as match$1 } from "../Option-DkxSnBhp.mjs";
+import { A as Option, G as URLFromString, I as Struct, mt as is, pt as fromJsonString, st as encodeEffect, tt as decodeEffect } from "../Schema-MiKt5K1v.mjs";
+import { C as put, h as bodyUint8Array, w as setHeaders } from "../HttpClientResponse-D5ZKICVV.mjs";
+import { a as Deploy, i as CustomerHostname, o as EnvironmentName, t as AppName, u as OrganizationName } from "../cloud-client.adapter-Cy1BjDbG.mjs";
+import { BuildBundle } from "./build-bundle.adapter.mjs";
+import { t as CloudClient } from "../cloud-client.adapter-DOVMoYAj.mjs";
+import { cloudUrl } from "./cloud-url.pure.mjs";
+import { DeployFailedError } from "./deploy-failed.errors.mjs";
+import { progressFailure, progressMessage, progressWait, reconnectBackoff, requestFailure, retryable } from "./request-failure.pure.mjs";
+// src/deploy/deploy.service.ts
+const Target = Struct({
+	app: AppName,
+	domain: Option(CustomerHostname),
+	environment: EnvironmentName,
+	organization: OrganizationName
+});
+const lastNotice = -1;
+const ProgressOnStderr = Reference("@akterjs/cli/deploy/deploy.service/ProgressOnStderr", { defaultValue: () => false });
+const say = fn("say")(function* say(line) {
+	const onStderr = yield* ProgressOnStderr;
+	yield* match(onStderr, {
+		onFalse: () => log(line),
+		onTrue: () => error(line)
+	});
+});
+const timeoutFailure = (message) => (failure) => {
+	if (is(DeployFailedError)(failure)) return failure;
+	return DeployFailedError.make({ message });
+};
+const uploadBuild = fn("uploadBuild")(function* uploadBuild(cloud, built, upload) {
+	const destination = yield* decodeEffect(URLFromString)(upload.url).pipe(mapError(() => DeployFailedError.make({ message: "The API returned an invalid upload URL." })));
+	const local = [
+		"localhost",
+		"127.0.0.1",
+		"[::1]"
+	].includes(destination.hostname);
+	if (destination.username !== "" || destination.password !== "" || destination.protocol !== "https:" && !(local && destination.protocol === "http:")) return yield* DeployFailedError.make({ message: "The upload URL must use HTTPS, except on loopback." });
+	yield* say("Uploading build");
+	return yield* cloud.upload.execute(put(destination).pipe(bodyUint8Array(built.bundle), setHeaders(upload.headers))).pipe(flatMap((response) => response.arrayBuffer), timeout("5 minutes"), mapError(requestFailure("Build upload")), asVoid);
+});
+const confirmBuild = fn("confirmBuild")(function* confirmBuild(cloud, target, initial) {
+	let ready = initial;
+	while (ready.status !== "Ready") {
+		if (ready.status === "Failed") return yield* DeployFailedError.make({ message: "The uploaded build failed validation." });
+		ready = yield* cloud.request(cloud.client.buildsGet(target.organization, target.app, ready.id, {}), "30 seconds").pipe(mapError(requestFailure("Build confirmation")));
+		if (ready.status !== "Ready") yield* sleep("1 second");
+	}
+	return ready;
+});
+const prepareBuild = fn("prepareBuild")(function* prepareBuild(cloud, target, built) {
+	const created = yield* cloud.request(cloud.client.buildsCreate(target.organization, target.app, { payload: {
+		digest: built.digest,
+		manifest: built.manifest,
+		size: built.size
+	} }), "30 seconds").pipe(mapError(requestFailure("Build creation")));
+	if (isNotUndefined(created.upload)) yield* uploadBuild(cloud, built, created.upload);
+	return yield* confirmBuild(cloud, target, created.build).pipe(timeout("5 minutes"), mapError(timeoutFailure("Timed out confirming the uploaded build; no deploy was started.")));
+});
+const noticesOf = fn("noticesOf")(function* noticesOf(current, seen) {
+	const { notices, status } = current;
+	if (some(seen, (notice, index) => notices[index] !== notice) || notices.at(lastNotice) !== status) return yield* DeployFailedError.make({ message: "The API returned inconsistent deploy notices." });
+	yield* forEach(notices.slice(seen.length), (notice) => say(notice), { discard: true });
+	return notices;
+});
+const reasonText = type().pipe(discriminatorsExhaustive("code")({
+	"host-ceiling": ({ ceiling }) => `the environment already holds its ceiling of ${String(ceiling)} hosts, so a new one waits for a release`,
+	"load-failed": ({ message }) => `the app failed to load: ${message}`,
+	"no-answer": () => "the control plane never answered",
+	"no-host": () => "no host",
+	"no-host-up": () => "no host is up",
+	"owners-missing": ({ published, serving, shards }) => `${String(published)} of ${String(shards)} shards have a published owner (${String(serving)} serving)`
+}));
+const finished = (current) => {
+	if (current.status === "RolledBack") return fail(DeployFailedError.make({ message: `Deploy ${current.id} rolled back.` }));
+	if (current.status === "NotServing") {
+		const why = match$1(fromUndefinedOr(current.reason), {
+			onNone: () => "no reason given",
+			onSome: reasonText
+		});
+		return fail(DeployFailedError.make({ message: `Deploy ${current.id} is published but not serving: ${why}.` }));
+	}
+	return succeed(current);
+};
+const progressOf = (cloud, target, deploy) => {
+	const poll = cloud.request(cloud.progress.deploysGet(target.organization, target.app, deploy.id, {}), progressWait);
+	return poll.pipe(catchIf(retryable, (failure) => say(`${progressMessage(failure)} Reconnecting; the deploy continues on the server.`).pipe(andThen(retry(poll, {
+		schedule: reconnectBackoff,
+		while: retryable
+	})))), mapError(progressFailure));
+};
+const followDeploy = fn("followDeploy")(function* followDeploy(cloud, target, initial) {
+	let current = initial;
+	let seen = [];
+	while (current.status !== "Live" && current.status !== "NotServing" && current.status !== "RolledBack") {
+		seen = yield* noticesOf(current, seen);
+		yield* sleep("1 second");
+		current = yield* progressOf(cloud, target, initial);
+	}
+	yield* noticesOf(current, seen);
+	return yield* finished(current);
+});
+const claimDomain = fn("claimDomain")(function* claimDomain(cloud, target) {
+	if (isNone(target.domain)) return;
+	const hostname = target.domain.value;
+	const registered = yield* cloud.request(cloud.client.domainsCreate(target.organization, target.app, { payload: {
+		environment: target.environment,
+		hostname
+	} }), "30 seconds").pipe(mapError(requestFailure("Domain registration")), filterOrFail((domain) => domain.hostname === hostname && domain.environment === target.environment && domain.status !== "Removing", () => DeployFailedError.make({ message: "The API returned an unavailable or mismatched domain." })));
+	yield* say(`Add CNAME ${registered.hostname} -> ${registered.cname}`);
+});
+const deployed = fn("deployed")(function* deployed(options) {
+	const target = yield* decodeEffect(Target)(options).pipe(mapError(() => DeployFailedError.make({ message: "App, organization, environment and domain must be valid Cloud names." })));
+	const url = yield* cloudUrl(options.url);
+	const cloud = yield* CloudClient.use((factory) => factory.connect({
+		apiKey: options.apiKey,
+		url
+	}));
+	yield* claimDomain(cloud, target);
+	const built = yield* say("Building app").pipe(andThen(BuildBundle.use((builder) => builder.bundle(options.entry))), mapError(() => DeployFailedError.make({ message: "Could not build the app and its manifest." })));
+	yield* cloud.signIn;
+	const ready = yield* prepareBuild(cloud, target, built);
+	const current = yield* cloud.request(cloud.client.deploysCreate(target.organization, target.app, { payload: {
+		build: ready.id,
+		environment: target.environment
+	} }), "30 seconds").pipe(mapError(requestFailure("Deploy creation")));
+	yield* say(`Deploy ${current.id}`);
+	return yield* followDeploy(cloud, target, current).pipe(timeout("30 minutes"), mapError(timeoutFailure(`Stopped following deploy ${current.id} after 30 minutes; the deploy continues on the server.`)));
+});
+const DeployJson = fromJsonString(Deploy);
+const announced = fn("announced")(function* announced(live, json) {
+	const line = yield* match(json, {
+		onFalse: () => succeed(map$1(fromUndefinedOr(live.url), (url) => `Actors at ${url}`)),
+		onTrue: () => asSome(orDie(encodeEffect(DeployJson)(live)))
+	});
+	yield* match$1(line, {
+		onNone: () => void_,
+		onSome: (text) => log(text)
+	});
+});
+const runDeploy = fn("runDeploy")(function* runDeploy(options) {
+	const live = yield* deployed(options).pipe(provideService(ProgressOnStderr, options.json));
+	yield* announced(live, options.json);
+	return live;
+});
+var Deployment = class extends Service()("@akterjs/cli/deploy/deploy.service/Deployment", { make: gen(function* makeDeployment() {
+	const context$1 = yield* context().pipe(map(pick(BuildBundle, CloudClient)));
+	return { run: (options) => provideContext(runDeploy(options), context$1) };
+}) }) {
+	static layer = effect(this, this.make).pipe(provide(merge(BuildBundle.layer, CloudClient.layer)));
+};
+export { Deployment };