@assemblyline-agents/cli 5.0.10 → 6.0.0

package/dist/deploy.js

@@ -1,22 +1,23 @@
-import { spawn } from "node:child_process";
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
-import { buildAgent, compileAgent, deployTargetCredentialNames, planDeployment } from "@assemblyline-agents/compiler";
-import { adapterProviderMetadata, isSensitiveSandboxEnvName, sanitizeDeployName } from "@assemblyline-agents/core";
-import { createCredentialBoundary, installSignalHandlers, listenNodeRuntime, resolveCredentialInventory, resolveGatewayCredentials, resolveProvider } from "@assemblyline-agents/node";
-import { FileStateAdapter, LocalBlobAdapter, LocalSandboxAdapter, AssemblyLineRuntime, loadRuntimeBundle } from "@assemblyline-agents/runtime";
+import { rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { buildAgent, compileAgent, planDeployment } from "@assemblyline-agents/compiler";
+import { installSignalHandlers, listenNodeRuntime } from "@assemblyline-agents/node";
+import { AssemblyLineRuntime, FileStateAdapter, LocalBlobAdapter, LocalSandboxAdapter, loadRuntimeBundle } from "@assemblyline-agents/runtime";
 import { booleanFlag, buildOptions, numberFlag, stringFlag } from "./args.js";
-import { printIssues } from "./help.js";
-import { missingPackageFixLines } from "./init.js";
-import { manifestUsesModelProvider } from "./model-providers.js";
-import { checkChannelInstallations } from "./channels.js";
-import { wireConnectionEvents } from "./connections.js";
 import { resolveDeployDefinition, resolveDeployEnvironment } from "./deploy-definition.js";
-import { executeDeployCleanup, executeDeployLifecycle } from "./deploy-lifecycle.js";
-import { readEnvSecretsFile } from "./project-env.js";
-import { prepareReleaseSnapshot, releaseSnapshotForReceipt, withReleaseSnapshot, } from "./release-history.js";
+import { effectiveMissingRequirements, preflightChannelInstallations, printDeployWarnings } from "./deploy-preflight.js";
+import { assertDestroyAllowed, localDeployReceipt, removeDeployReceipts, writeDeployReceipt } from "./deploy-receipts.js";
+import { reusableSandboxEnvironmentResolutions } from "./deploy-sandbox-environments.js";
+import { resolveDeploySecretsEnv } from "./deploy-secrets.js";
+import { printIssues } from "./help.js";
+import { runProviderDeploy } from "./provider-deploy.js";
+import { prepareReleaseSnapshot } from "./release-history.js";
 export { parseEnvSecrets } from "./project-env.js";
+export { runCommand } from "./deploy-migrations.js";
+export { writeJson } from "./deploy-receipts.js";
+export { reusableSandboxEnvironmentResolutions, sandboxPassthroughEnv } from "./deploy-sandbox-environments.js";
+export { splitDeploySecrets, withDeclaredRuntimeEnv } from "./deploy-secrets.js";
+/** Compile, plan, and dispatch one deployment through the selected plugin graph. */
 export async function runDeployCommand(agentRoot, parsed) {
     const deployOptions = {
         environment: "development",
@@ -32,8 +33,7 @@ export async function runDeployCommand(agentRoot, parsed) {
         const overlay = await resolveDeploySecretsEnv(manifest, agentRoot, target ?? manifest.gateway.deploy?.kind ?? "local");
         const plan = planDeployment(manifest, { ...deployOptions, env: overlay.env });
         plan.storeHeldCredentials = overlay.storeNames;
-        const definition = resolveDeployDefinition(manifest, plan.target, parsed);
-        plan.missingRequirements = await effectiveMissingRequirements(plan, definition, manifest);
+        plan.missingRequirements = effectiveMissingRequirements(plan, manifest);
         printDeployWarnings(plan);
         console.log(JSON.stringify(plan, null, 2));
         return;
@@ -51,65 +51,21 @@ export async function runDeployCommand(agentRoot, parsed) {
     const definition = resolveDeployDefinition(artifact.manifest, plan.target, parsed);
     const effectivePlan = {
         ...plan,
-        missingRequirements: await effectiveMissingRequirements(plan, definition, artifact.manifest, reusableSandboxEnvironmentResolutions(artifact, plan.environment)),
+        missingRequirements: effectiveMissingRequirements(plan, artifact.manifest, reusableSandboxEnvironmentResolutions(artifact, plan.environment)),
         canPublish: false
     };
     effectivePlan.canPublish = !effectivePlan.dryRun && effectivePlan.missingRequirements.length === 0;
     printDeployWarnings(effectivePlan);
     console.log(JSON.stringify(effectivePlan, null, 2));
-    if (effectivePlan.dryRun)
-        return;
     if (effectivePlan.missingRequirements.length > 0) {
         console.error("Missing deploy setup:");
         for (const requirement of effectivePlan.missingRequirements) {
             console.error(`- ${requirement.name}: ${requirement.message}`);
-            for (const line of missingPackageFixLines(requirement.adapter, agentRoot))
-                console.error(line);
         }
         process.exit(1);
     }
     if (effectivePlan.target === "local") {
-        if (booleanFlag(parsed, "destroy")) {
-            assertDestroyAllowed(effectivePlan, parsed);
-            if (booleanFlag(parsed, "purge-data")) {
-                for (const entry of ["deploy-state.json", "blobs", "sandbox"]) {
-                    rmSync(resolve(artifact.root, entry), { recursive: true, force: true });
-                }
-            }
-            removeDeployReceipts(artifact.root, effectivePlan);
-            console.log(`Local deploy environment "${effectivePlan.environment}" destroyed${booleanFlag(parsed, "purge-data") ? " (data purged)" : ""}.`);
-            return;
-        }
-        if (booleanFlag(parsed, "serve") || booleanFlag(parsed, "once")) {
-            const runtimeOptions = loadRuntimeBundle(artifact.root);
-            if (booleanFlag(parsed, "once")) {
-                new AssemblyLineRuntime({ ...runtimeOptions, devMode: true }).boot();
-                writeDeployReceipt(artifact.root, effectivePlan, localDeployReceipt(artifact, effectivePlan, "checked", null));
-                console.log(`Local deploy serving revision ${effectivePlan.agentRevision}`);
-                console.log("local deploy check completed without binding a socket");
-                return;
-            }
-            const handle = await listenNodeRuntime({
-                ...runtimeOptions,
-                state: new FileStateAdapter(resolve(artifact.root, "deploy-state.json")),
-                blob: new LocalBlobAdapter(resolve(artifact.root, "blobs")),
-                sandbox: new LocalSandboxAdapter(resolve(artifact.root, "sandbox")),
-                env: overlay.boundary.config,
-                credentialStore: overlay.boundary.store,
-                gatewayCredentials: await resolveGatewayCredentials(overlay.boundary, runtimeOptions.manifest),
-                devMode: true,
-                port: numberFlag(parsed, "port") ?? 0
-            });
-            writeDeployReceipt(artifact.root, effectivePlan, localDeployReceipt(artifact, effectivePlan, "serving", handle.url));
-            console.log(`Local deploy serving revision ${effectivePlan.agentRevision}`);
-            console.log(handle.url);
-            // SIGTERM/SIGINT drain in-flight runs before exit; a second signal exits immediately.
-            installSignalHandlers(handle);
-            await handle.closed;
-            return;
-        }
-        writeDeployReceipt(artifact.root, effectivePlan, localDeployReceipt(artifact, effectivePlan, "prepared", null));
-        console.log(`Local deploy prepared for revision ${effectivePlan.agentRevision}. Run assembly-line serve to keep it online.`);
+        await runLocalDeploy(artifact, effectivePlan, parsed, deployEnv);
         return;
     }
     const release = !booleanFlag(parsed, "destroy") && !booleanFlag(parsed, "ingress-only")
@@ -117,586 +73,44 @@ export async function runDeployCommand(agentRoot, parsed) {
         : undefined;
     await runProviderDeploy(artifact, effectivePlan, definition, parsed, agentRoot, release, deployEnv);
 }
-/**
- * The env view deploy planning and secret sync work from: the process
- * environment overlaid with the gateway's secrets store when one is
- * configured, so declared secrets held only in the store still satisfy
- * preflight and reach `--sync-secrets` without per-agent `.env` copies.
- */
-async function resolveDeploySecretsEnv(manifest, agentRoot, target) {
-    const boundary = await createCredentialBoundary({
-        manifest,
-        env: process.env,
-        additionalCredentialNames: deployTargetCredentialNames(manifest, target),
-        artifactRoot: agentRoot,
-        providerRoot: fileURLToPath(new URL("..", import.meta.url)),
-        devMode: false
-    });
-    return { ...(await resolveCredentialInventory(boundary)), boundary };
-}
-async function preflightChannelInstallations(artifact, deployEnv) {
-    const checks = await checkChannelInstallations(artifact.manifest, deployEnv, fetch);
-    for (const check of checks) {
-        const workspace = check.workspace ? ` (${check.workspace})` : "";
-        if (check.skipped) {
-            console.warn(`Channel preflight skipped for ${check.provider}${workspace}: ${check.detail}`);
-            continue;
-        }
-        if (!check.ok)
-            throw new Error(`Channel preflight failed for ${check.provider}${workspace}: ${check.detail}`);
-        console.log(`Channel preflight passed for ${check.provider}${workspace}.`);
-        if (check.missingOptionalScopes.length > 0) {
-            console.warn(`Optional ${check.provider} scopes not granted: ${check.missingOptionalScopes.join(", ")}.`);
-        }
-    }
-}
-/**
- * The canonical receipt is per environment (`deployments/<environment>.json`).
- * The legacy `deployment.json` keeps its exact historical behavior — always
- * written, last deploy wins — so existing readers are unaffected; new readers
- * should prefer the environment-scoped file.
- */
-function environmentReceiptPath(artifactRoot, environment) {
-    return resolve(artifactRoot, "deployments", `${sanitizeDeployName(environment)}.json`);
-}
-function writeDeployReceipt(artifactRoot, plan, receipt) {
-    writeJson(environmentReceiptPath(artifactRoot, plan.environment), receipt);
-    writeJson(resolve(artifactRoot, "deployment.json"), receipt);
-}
-function removeDeployReceipts(artifactRoot, plan) {
-    rmSync(environmentReceiptPath(artifactRoot, plan.environment), { force: true });
-    // The legacy mirror is last-deploy-wins; drop it only when it belongs to the
-    // environment being destroyed, otherwise it still describes a live deploy.
-    const legacyPath = resolve(artifactRoot, "deployment.json");
-    try {
-        const legacy = JSON.parse(readFileSync(legacyPath, "utf8"));
-        if (legacy.environment === plan.environment)
-            rmSync(legacyPath, { force: true });
-    }
-    catch {
-        // Unreadable or absent legacy receipt: leave it alone.
-    }
-}
-function assertDestroyAllowed(plan, parsed) {
-    if (plan.environment === plan.defaultEnvironment && !booleanFlag(parsed, "force")) {
-        throw new Error(`Refusing to destroy the default environment "${plan.environment}" without --force. Alternate environments (--env <name>) are presumed disposable; the default one is not.`);
-    }
-}
-async function effectiveMissingRequirements(plan, definition, manifest, reusableSandboxEnvironments) {
-    let missing = plan.missingRequirements;
-    // VPS runtime credentials are validated from the remote 0600 secret file
-    // after optional sync. This allows repeat deploys without copying secrets
-    // from the VPS back onto the operator machine.
-    if (plan.target === "vps" && !plan.dryRun) {
-        const sandboxKind = manifest.gateway.sandbox?.kind ?? "local";
-        const provisioningEnv = new Set(adapterProviderMetadata(sandboxKind, "sandbox")?.sandboxEnvironment?.provisioningEnv ?? []);
-        missing = missing.filter((requirement) => requirement.kind !== "env"
-            || (provisioningEnv.has(requirement.name) && !reusableSandboxEnvironments));
-    }
-    if (plan.target === "railway" && missing.some((requirement) => requirement.name === "RAILWAY_TOKEN")) {
-        const railwayBin = stringOption(definition, "railwayBin") ?? "railway";
-        if (await railwayCliAuthenticated(railwayBin)) {
-            missing = missing.filter((requirement) => requirement.name !== "RAILWAY_TOKEN");
-        }
-    }
-    if (plan.target === "fly" && !stringOption(definition, "app")) {
-        missing = [
-            ...missing,
-            {
-                kind: "deploy",
-                name: "fly-app",
-                required: true,
-                adapter: "fly",
-                message: "Fly deploys require --fly-app or FLY_APP_NAME."
-            }
-        ];
-    }
-    if (plan.target === "vps") {
-        if (!stringOption(definition, "host")) {
-            missing = [
-                ...missing,
-                {
-                    kind: "deploy",
-                    name: "vps-host",
-                    required: true,
-                    adapter: "vps",
-                    message: "VPS deploys require a named host through vpsDeploy() or --vps-host."
-                }
-            ];
-        }
-    }
-    return missing;
-}
-function printDeployWarnings(plan) {
-    if (plan.warnings.length === 0)
-        return;
-    console.warn("Deploy warnings:");
-    for (const warning of plan.warnings)
-        console.warn(`- ${warning.name}: ${warning.message}`);
-}
-/**
- * Push the project's local secrets to the deploy target when `--sync-secrets`
- * is set and the publisher supports it. An optional `--secrets-from <path>`
- * is explicit private input; project `.env` files are never loaded implicitly.
- */
-async function syncDeploySecretsIfRequested(publisher, plan, parsed, deployEnv) {
-    if (!booleanFlag(parsed, "sync-secrets"))
-        return;
-    if (!publisher.syncSecrets) {
-        console.warn(`Deploy target ${publisher.target} does not support secret sync; set variables on the target manually.`);
-        return;
-    }
-    const secretsPath = stringFlag(parsed, "secrets-from");
-    if (secretsPath && !existsSync(secretsPath)) {
-        throw new Error(`Secrets file not found: ${secretsPath}`);
-    }
-    const fileSecrets = secretsPath ? readEnvSecretsFile(secretsPath) : {};
-    const secrets = withDeclaredRuntimeEnv(fileSecrets, plan, deployEnv);
-    const { runtimeSecrets, localDeployKeys, storeHeldKeys } = splitDeploySecrets(secrets, plan);
-    if (localDeployKeys.length > 0) {
-        console.log(`Kept ${localDeployKeys.length} deploy credential(s) local: ${localDeployKeys.join(", ")}`);
-    }
-    if (storeHeldKeys.length > 0) {
-        console.log(`Left ${storeHeldKeys.length} credential(s) in the gateway store (resolved on use, not synced): ${storeHeldKeys.join(", ")}`);
-    }
-    const receipt = await publisher.syncSecrets(runtimeSecrets, plan);
-    console.log(`Synced ${receipt.syncedKeys.length} secret(s) to ${publisher.target}: ${receipt.syncedKeys.join(", ") || "(none)"}`);
-    if (receipt.skippedKeys.length > 0) {
-        console.log(`Skipped ${receipt.skippedKeys.length} empty key(s): ${receipt.skippedKeys.join(", ")}`);
-    }
-}
-export function withDeclaredRuntimeEnv(fileSecrets, plan, env) {
-    const committedConfig = new Set(plan.committedConfig ?? []);
-    const secrets = Object.fromEntries(Object.entries(fileSecrets).filter(([name]) => !committedConfig.has(name)));
-    for (const requirement of plan.requirements) {
-        if (requirement.kind !== "env" || requirement.adapter === plan.target)
-            continue;
-        for (const key of [requirement.name, ...(requirement.alternatives ?? [])]) {
-            if (committedConfig.has(key))
-                continue;
-            if (env[key] !== undefined)
-                secrets[key] = env[key] ?? "";
-        }
-    }
-    return secrets;
-}
-/**
- * Partition candidate sync values: direct deploy credentials stay on the
- * operator's machine, deploy sub-capability credentials are handed to the
- * trusted publisher, ordinary store-held runtime credentials stay in the
- * store, and everything else is pushed to the target.
- */
-export function splitDeploySecrets(secrets, plan) {
-    const storeHeld = new Set(plan.storeHeldCredentials ?? []);
-    const deployCredentials = new Set(plan.deployCredentialNames ?? []);
-    const committedConfig = new Set(plan.committedConfig ?? []);
-    const deployKeys = new Set(plan.requirements
-        .filter((requirement) => requirement.kind === "env" && requirement.adapter === plan.target)
-        .flatMap((requirement) => [requirement.name, ...(requirement.alternatives ?? [])]));
-    const runtimeKeys = new Set(plan.requirements
-        .filter((requirement) => requirement.kind === "env" && requirement.adapter !== plan.target)
-        .flatMap((requirement) => [requirement.name, ...(requirement.alternatives ?? [])]));
-    const runtimeSecrets = {};
-    const localDeployKeys = [];
-    const storeHeldKeys = [];
-    for (const [key, value] of Object.entries(secrets)) {
-        if (committedConfig.has(key)) {
-            continue;
-        }
-        else if (deployKeys.has(key) && !runtimeKeys.has(key)) {
-            localDeployKeys.push(key);
-        }
-        else if (storeHeld.has(key) && !deployCredentials.has(key)) {
-            storeHeldKeys.push(key);
-        }
-        else {
-            runtimeSecrets[key] = value;
-        }
-    }
-    return { runtimeSecrets, localDeployKeys, storeHeldKeys: storeHeldKeys.sort() };
-}
-async function railwayCliAuthenticated(railwayBin) {
-    try {
-        const result = await runCommand(railwayBin, ["whoami"], {
-            cwd: process.cwd(),
-            env: process.env,
-            silent: true
-        });
-        return result.exitCode === 0;
-    }
-    catch {
-        return false;
-    }
-}
-/**
- * Every non-local target resolves through the open provider registry. Built-in
- * flags only normalize provider options; publishing follows this single path.
- */
-async function runProviderDeploy(artifact, plan, definition, parsed, agentRoot, release, deployEnv) {
-    if (parsed.flags["domains-only"] !== undefined) {
-        throw new Error("--domains-only was removed. Use --ingress-only.");
-    }
-    // Preflight checks requirements against the store-overlaid deploy env, so
-    // the publisher must resolve from the same view or a store-held deploy
-    // credential would pass preflight and then fail provider resolution.
-    const publisher = await resolveProvider("deploy", definition, {
-        env: deployEnv,
-        fetch,
-        manifest: artifact.manifest,
-        artifactRoot: artifact.root,
-        providerRoot: fileURLToPath(new URL("..", import.meta.url)),
-        devMode: false
-    });
-    const modeFlags = ["prepare-only", "activate", "rollback", "ingress-only", "destroy"]
-        .filter((flag) => booleanFlag(parsed, flag));
-    if (modeFlags.length > 1) {
-        throw new Error(`Deploy lifecycle flags are mutually exclusive: ${modeFlags.map((flag) => `--${flag}`).join(", ")}.`);
-    }
+async function runLocalDeploy(artifact, plan, parsed, deployEnv) {
     if (booleanFlag(parsed, "destroy")) {
-        if (!publisher.destroy)
-            throw new Error(`Deploy target ${plan.target} does not support destroy.`);
         assertDestroyAllowed(plan, parsed);
-        // No preflight: destroy must not provision anything on the way out.
-        const receipt = await publisher.destroy(artifact, plan, { purgeData: booleanFlag(parsed, "purge-data") });
+        if (booleanFlag(parsed, "purge-data")) {
+            for (const entry of ["deploy-state.json", "blobs", "sandbox"]) {
+                rmSync(resolve(artifact.root, entry), { recursive: true, force: true });
+            }
+        }
         removeDeployReceipts(artifact.root, plan);
-        console.log(`${deployTargetLabel(plan.target)} environment "${plan.environment}" destroyed${booleanFlag(parsed, "purge-data") ? " (data purged)" : ""}.`);
-        console.log(JSON.stringify(receipt, null, 2));
-        return;
-    }
-    if (booleanFlag(parsed, "activate")) {
-        if (!publisher.activate)
-            throw new Error(`Deploy target ${plan.target} does not support separate activation.`);
-        const activate = publisher.activate;
-        await publisher.preflight?.(artifact, plan);
-        const providerReceipt = await deployActionWithCleanup(publisher, artifact, plan, () => activate.call(publisher, artifact, plan));
-        const receipt = withReleaseSnapshot(providerReceipt, releaseSnapshotForReceipt(release, providerReceipt, true));
-        writeDeployReceipt(artifact.root, plan, receipt);
-        await wireDeployedConnectionEvents(artifact.manifest, receipt);
-        console.log(`${deployTargetLabel(plan.target)} prepared release activated.`);
-        console.log(JSON.stringify(receipt, null, 2));
-        return;
-    }
-    if (booleanFlag(parsed, "rollback")) {
-        if (!publisher.rollback)
-            throw new Error(`Deploy target ${plan.target} does not support rollback.`);
-        const rollback = publisher.rollback;
-        await publisher.preflight?.(artifact, plan);
-        const providerReceipt = await deployActionWithCleanup(publisher, artifact, plan, () => rollback.call(publisher, artifact, plan));
-        const receipt = withReleaseSnapshot(providerReceipt, releaseSnapshotForReceipt(release, providerReceipt, true));
-        writeDeployReceipt(artifact.root, plan, receipt);
-        await wireDeployedConnectionEvents(artifact.manifest, receipt);
-        console.log(`${deployTargetLabel(plan.target)} release rolled back.`);
-        console.log(JSON.stringify(receipt, null, 2));
+        console.log(`Local deploy environment "${plan.environment}" destroyed${booleanFlag(parsed, "purge-data") ? " (data purged)" : ""}.`);
         return;
     }
-    if (booleanFlag(parsed, "ingress-only")) {
-        if (!publisher.reconcileIngress)
-            throw new Error(`Deploy target ${plan.target} does not support ingress reconciliation.`);
-        const reconcileIngress = publisher.reconcileIngress;
-        await publisher.preflight?.(artifact, plan);
-        const receipt = await deployActionWithCleanup(publisher, artifact, plan, () => reconcileIngress.call(publisher, artifact, plan));
-        writeDeployReceipt(artifact.root, plan, receipt);
-        console.log(`${deployTargetLabel(plan.target)} ingress reconciled.`);
-        console.log(JSON.stringify(receipt, null, 2));
-        return;
-    }
-    const prepareOnly = booleanFlag(parsed, "prepare-only");
-    const reconcileSandboxEnvironment = sandboxEnvironmentReconciler(artifact, deployEnv, reusableSandboxEnvironmentResolutions(artifact, plan.environment));
-    console.log(`${prepareOnly ? "Preparing" : "Publishing"} Assembly Line revision ${plan.agentRevision} with ${plan.target}.`);
-    const migrationRequest = configuredMigrationRequest(artifact, parsed);
-    const progressStages = [
-        "preflight",
-        ...(reconcileSandboxEnvironment ? ["sandbox-environment"] : []),
-        "prepare",
-        "secrets",
-        "migrations",
-        ...(!prepareOnly ? ["activate"] : []),
-        ...(publisher.cleanup ? ["cleanup"] : [])
-    ];
-    const progressLabels = {
-        preflight: "Checking provider and host",
-        "sandbox-environment": "Reconciling sandbox environment",
-        prepare: "Uploading artifact and preparing runtime image",
-        secrets: "Reconciling runtime secrets",
-        migrations: "Running migrations",
-        activate: "Activating and health-checking the release",
-        cleanup: "Cleaning managed deployment artifacts"
-    };
-    const { providerReceipt, migrationStatus, lifecycle, sandboxEnvironments } = await executeDeployLifecycle({
-        publisher,
-        artifact,
-        plan,
-        migrationRequest,
-        activate: !prepareOnly,
-        ...(reconcileSandboxEnvironment ? { reconcileSandboxEnvironment } : {}),
-        syncSecrets: () => syncDeploySecretsIfRequested(publisher, plan, parsed, deployEnv),
-        runFallbackMigrations: () => runConfiguredMigrations(artifact, plan, migrationRequest),
-        onProgress: (stage) => {
-            const index = progressStages.indexOf(stage);
-            if (index >= 0)
-                console.log(`[${index + 1}/${progressStages.length}] ${progressLabels[stage]}`);
+    if (booleanFlag(parsed, "serve") || booleanFlag(parsed, "once")) {
+        const runtimeOptions = loadRuntimeBundle(artifact.root);
+        if (booleanFlag(parsed, "once")) {
+            new AssemblyLineRuntime({ ...runtimeOptions, devMode: true }).boot();
+            writeDeployReceipt(artifact.root, plan, localDeployReceipt(artifact, plan, "checked", null));
+            console.log(`Local deploy serving revision ${plan.agentRevision}`);
+            console.log("local deploy check completed without binding a socket");
+            return;
         }
-    });
-    const providerLifecycleReceipt = {
-        ...providerReceipt,
-        migrationStatus,
-        ...(sandboxEnvironments ? { sandboxEnvironments } : {}),
-        ...(Object.keys(lifecycle).length > 0 ? { lifecycle } : {})
-    };
-    const receipt = withReleaseSnapshot(providerLifecycleReceipt, releaseSnapshotForReceipt(release, providerLifecycleReceipt, !prepareOnly));
-    writeDeployReceipt(artifact.root, plan, receipt);
-    if (!prepareOnly)
-        await wireDeployedConnectionEvents(artifact.manifest, receipt);
-    console.log(`${deployTargetLabel(plan.target)} deploy ${prepareOnly ? "prepared" : "completed"}.`);
-    if (manifestUsesModelProvider(artifact.manifest, "openai-codex")) {
-        console.log(`The release is ready for provider login. Run \`assembly-line auth openai-codex <agentRoot> --target ${plan.target} --env ${plan.environment}${prepareOnly ? " --prepared" : ""}\`; OAuth tokens never appear in command arguments or deployment receipts.`);
-    }
-    console.log(JSON.stringify(receipt, null, 2));
-}
-async function deployActionWithCleanup(publisher, artifact, plan, action) {
-    try {
-        const receipt = await action();
-        const cleanup = await executeDeployCleanup({ publisher, artifact, plan });
-        return cleanup ? { ...receipt, cleanup } : receipt;
-    }
-    catch (error) {
-        await executeDeployCleanup({ publisher, artifact, plan });
-        throw error;
-    }
-}
-async function wireDeployedConnectionEvents(manifest, receipt) {
-    if (!manifest.connections.some((connection) => connection.events?.enabled))
-        return;
-    const deploymentUrl = receiptField(receipt, "deploymentUrl");
-    if (!deploymentUrl) {
-        console.warn("Connection events were not wired because the deploy target did not return a public deployment URL. Run `assembly-line connections wire <agentRoot> --url <publicUrl>` after ingress is available.");
-        return;
-    }
-    const result = await wireConnectionEvents({
-        baseUrl: deploymentUrl,
-        ...(process.env.ASSEMBLY_LINE_ADMIN_TOKEN ? { token: process.env.ASSEMBLY_LINE_ADMIN_TOKEN } : {}),
-        force: false
-    });
-    console.log("Connection event subscriptions reconciled.");
-    console.log(JSON.stringify(result, null, 2));
-}
-function receiptField(receipt, name) {
-    if (!receipt || typeof receipt !== "object" || Array.isArray(receipt))
-        return undefined;
-    const value = receipt[name];
-    return typeof value === "string" && value.trim() ? value.trim() : undefined;
-}
-// deployEnv is the store-overlaid environment: sandbox provisioning env and
-// passthrough projections must see secrets held only in the secret store.
-function sandboxEnvironmentReconciler(artifact, deployEnv, reusableResolutions) {
-    const definition = artifact.manifest.gateway.sandbox;
-    if (!definition || definition.kind === "local")
-        return undefined;
-    const sandboxes = artifact.manifest.sandboxes.filter((candidate) => candidate.adapter === definition.kind && candidate.environment);
-    if (sandboxes.length === 0)
-        return undefined;
-    if (reusableResolutions)
-        return async () => reusableResolutions;
-    return async () => {
-        const provider = await resolveProvider("sandbox", definition, {
+        const handle = await listenNodeRuntime({
+            ...runtimeOptions,
+            state: new FileStateAdapter(resolve(artifact.root, "deploy-state.json")),
+            blob: new LocalBlobAdapter(resolve(artifact.root, "blobs")),
+            sandbox: new LocalSandboxAdapter(resolve(artifact.root, "sandbox")),
             env: deployEnv,
-            fetch,
-            manifest: artifact.manifest,
-            artifactRoot: artifact.root,
-            providerRoot: fileURLToPath(new URL("..", import.meta.url)),
-            devMode: false
+            devMode: true,
+            port: numberFlag(parsed, "port") ?? 0
         });
-        if (!provider.ensureEnvironment) {
-            throw new Error(`Sandbox provider ${definition.kind} cannot reconcile compiled environments.`);
-        }
-        const resolutions = {};
-        for (const sandbox of sandboxes) {
-            const environment = sandbox.environment;
-            if (!environment)
-                throw new Error(`Sandbox profile ${sandbox.name} has no compiled environment.`);
-            const passthroughEnv = sandboxPassthroughEnv(deployEnv, sandbox.env);
-            resolutions[sandbox.name] = await provider.ensureEnvironment({
-                agentId: artifact.manifest.agent.id ?? artifact.manifest.agent.name ?? "agent",
-                sandboxName: sandbox.name,
-                adapter: definition.kind,
-                artifactRoot: artifact.root,
-                environment,
-                ...(Object.keys(passthroughEnv).length > 0 ? { env: passthroughEnv } : {})
-            });
-        }
-        return resolutions;
-    };
-}
-/**
- * Reuse a sandbox artifact proven by a successful receipt when its provider and
- * content fingerprint are unchanged. Runtime credentials stay on the host;
- * only the provider-safe artifact reference crosses deploys.
- */
-export function reusableSandboxEnvironmentResolutions(artifact, environmentName) {
-    const definition = artifact.manifest.gateway.sandbox;
-    if (!definition || definition.kind === "local")
-        return undefined;
-    const sandboxes = artifact.manifest.sandboxes.filter((candidate) => candidate.adapter === definition.kind && candidate.environment);
-    if (sandboxes.length === 0)
-        return undefined;
-    const candidates = [
-        environmentReceiptPath(artifact.root, environmentName),
-        resolve(artifact.root, "deployment.json")
-    ];
-    for (const path of candidates) {
-        try {
-            const receipt = JSON.parse(readFileSync(path, "utf8"));
-            if (receipt.status !== "published" || receipt.environment !== environmentName)
-                continue;
-            const stored = receipt.sandboxEnvironments;
-            if (!stored || typeof stored !== "object" || Array.isArray(stored))
-                continue;
-            const resolutions = {};
-            let matches = true;
-            for (const sandbox of sandboxes) {
-                const fingerprint = sandbox.environment?.fingerprint;
-                const resolution = stored[sandbox.name];
-                if (!fingerprint
-                    || !isSandboxEnvironmentResolution(resolution)
-                    || resolution.provider !== definition.kind
-                    || resolution.fingerprint !== fingerprint) {
-                    matches = false;
-                    break;
-                }
-                resolutions[sandbox.name] = { ...resolution, action: "reused" };
-            }
-            if (matches)
-                return resolutions;
-        }
-        catch {
-            // Missing, stale, or malformed receipts are not reuse evidence.
-        }
-    }
-    return undefined;
-}
-function isSandboxEnvironmentResolution(value) {
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        return false;
-    const record = value;
-    return ["provider", "artifactKind", "fingerprint", "artifactId", "runtimeReference"]
-        .every((key) => typeof record[key] === "string" && record[key].length > 0)
-        && ["reused", "built", "external"].includes(String(record.action));
-}
-export function sandboxPassthroughEnv(env, names) {
-    const values = {};
-    for (const name of names) {
-        const value = env[name];
-        if (value !== undefined)
-            values[name] = value;
-    }
-    const sensitive = Object.keys(values).filter(isSensitiveSandboxEnvName);
-    if (sensitive.length > 0) {
-        throw new Error(`Refusing host/control-plane secrets in sandbox profile env: ${sensitive.join(", ")}.`);
-    }
-    return values;
-}
-function deployTargetLabel(target) {
-    if (target === "railway")
-        return "Railway";
-    if (target === "docker")
-        return "Docker";
-    if (target === "fly")
-        return "Fly";
-    if (target === "vps")
-        return "VPS";
-    return target;
-}
-function stringOption(definition, name) {
-    const value = definition.options?.[name];
-    return typeof value === "string" ? value : undefined;
-}
-function configuredMigrationRequest(artifact, parsed) {
-    const entries = migrationEntriesForArtifact(artifact);
-    const command = stringFlag(parsed, "migration-command") ?? process.env.ASSEMBLY_LINE_MIGRATION_COMMAND;
-    if (entries.length > 0 && !command) {
-        throw new Error("Migration files are present, but no migration runner was configured. Pass --migration-command or set ASSEMBLY_LINE_MIGRATION_COMMAND.");
-    }
-    return {
-        entries,
-        ...(command ? { command } : {})
-    };
-}
-async function runConfiguredMigrations(artifact, plan, request) {
-    const entries = request.entries;
-    if (entries.length === 0)
-        return "none";
-    const commandName = request.command;
-    console.log(`Running ${entries.length} migration file(s) with ${commandName}.`);
-    const result = await runCommand(commandName, [], {
-        cwd: artifact.root,
-        env: {
-            ...process.env,
-            ASSEMBLY_LINE_ARTIFACT_ROOT: artifact.root,
-            ASSEMBLY_LINE_AGENT_REVISION: plan.agentRevision,
-            ASSEMBLY_LINE_DEPLOY_ENV: plan.environment,
-            ASSEMBLY_LINE_MIGRATION_FILES: JSON.stringify(entries)
-        }
-    });
-    if (result.exitCode !== 0) {
-        throw new Error(`Migration command failed with exit code ${result.exitCode}.`);
+        writeDeployReceipt(artifact.root, plan, localDeployReceipt(artifact, plan, "serving", handle.url));
+        console.log(`Local deploy serving revision ${plan.agentRevision}`);
+        console.log(handle.url);
+        installSignalHandlers(handle);
+        await handle.closed;
+        return;
     }
-    return `ran:${entries.length}`;
-}
-function migrationEntriesForArtifact(artifact) {
-    const migrationsDir = resolve(artifact.root, "migrations");
-    if (!existsSync(migrationsDir))
-        return [];
-    return readdirSync(migrationsDir)
-        .filter((entry) => entry !== "README.md" && !entry.startsWith("."))
-        .sort();
-}
-export function runCommand(commandName, args, options = {}) {
-    return new Promise((resolvePromise, reject) => {
-        const child = spawn(commandName, args, {
-            cwd: options.cwd ?? process.cwd(),
-            env: options.env ?? process.env,
-            stdio: ["ignore", "pipe", "pipe"]
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (chunk) => {
-            const text = chunk.toString("utf8");
-            stdout += text;
-            if (!options.silent)
-                process.stdout.write(text);
-        });
-        child.stderr.on("data", (chunk) => {
-            const text = chunk.toString("utf8");
-            stderr += text;
-            if (!options.silent)
-                process.stderr.write(text);
-        });
-        child.on("error", (error) => {
-            if (error.code === "ENOENT") {
-                reject(new Error(`${commandName} not found. Install it, or pass the matching --*-bin flag with the executable path.`));
-                return;
-            }
-            reject(error);
-        });
-        child.on("close", (code) => {
-            resolvePromise({ exitCode: code ?? 1, stdout, stderr });
-        });
-    });
-}
-function localDeployReceipt(artifact, plan, status, deploymentUrl) {
-    return {
-        target: "local",
-        status,
-        environment: plan.environment,
-        agentRevision: plan.agentRevision,
-        buildRevision: plan.buildRevision ?? plan.agentRevision,
-        artifactRoot: artifact.root,
-        deploymentUrl,
-        completedAt: new Date().toISOString()
-    };
-}
-export function writeJson(path, value) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+    writeDeployReceipt(artifact.root, plan, localDeployReceipt(artifact, plan, "prepared", null));
+    console.log(`Local deploy prepared for revision ${plan.agentRevision}. Run assembly-line serve to keep it online.`);
 }
 //# sourceMappingURL=deploy.js.map