@assemblyline-agents/cli 5.0.10 → 6.0.1

package/dist/deploy-definition.d.ts

@@ -1,14 +1,7 @@
 import type { AdapterDefinition, AgentManifest } from "@assemblyline-agents/core";
 import { type ParsedArgs } from "./args.js";
-/**
- * Resolve deploy configuration once so publish and hosted auth use identical
- * precedence. Environment scoping happens here because only this layer knows
- * whether an identity option (such as a Fly app) was configured in the
- * manifest — which non-default environments must scope — or passed explicitly
- * on the command line, which is always respected verbatim.
- */
+/** Resolve the selected deploy plugin without embedding provider option names in the CLI. */
 export declare function resolveDeployDefinition(manifest: AgentManifest, target: string, parsed: ParsedArgs, env?: Record<string, string | undefined>, cwd?: string): AdapterDefinition;
 export declare function resolveDeployEnvironment(manifest: AgentManifest, parsed: ParsedArgs, env?: Record<string, string | undefined>): string;
-/** The environment deploys land in when --env/ASSEMBLY_LINE_DEPLOY_ENV are absent. */
 export declare function resolveDefaultDeployEnvironment(manifest: AgentManifest): string;
 //# sourceMappingURL=deploy-definition.d.ts.map

package/dist/deploy-definition.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-definition.d.ts","sourceRoot":"","sources":["../src/deploy-definition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAc,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAuC,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEjF;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,GAAG,SAAgB,GAClB,iBAAiB,CAkDnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAMR;AAED,sFAAsF;AACtF,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAG/E"}
+{"version":3,"file":"deploy-definition.d.ts","sourceRoot":"","sources":["../src/deploy-definition.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,aAAa,EAAc,MAAM,2BAA2B,CAAC;AAC9F,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAExD,6FAA6F;AAC7F,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,EACrD,GAAG,SAAgB,GAClB,iBAAiB,CAqBnB;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,EAClB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GACpD,MAAM,CAMR;AAED,wBAAgB,+BAA+B,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAG/E"}

package/dist/deploy-definition.js

@@ -1,56 +1,27 @@
 import { environmentScopedName } from "@assemblyline-agents/core";
-import { booleanFlag, numberFlag, stringFlag } from "./args.js";
-/**
- * Resolve deploy configuration once so publish and hosted auth use identical
- * precedence. Environment scoping happens here because only this layer knows
- * whether an identity option (such as a Fly app) was configured in the
- * manifest — which non-default environments must scope — or passed explicitly
- * on the command line, which is always respected verbatim.
- */
+import { stringFlag } from "./args.js";
+/** Resolve the selected deploy plugin without embedding provider option names in the CLI. */
 export function resolveDeployDefinition(manifest, target, parsed, env = process.env, cwd = process.cwd()) {
-    const configured = manifest.gateway.deploy?.kind === target ? manifest.gateway.deploy : undefined;
-    const options = { ...(configured?.options ?? {}) };
-    const environment = resolveDeployEnvironment(manifest, parsed, env);
-    const defaultEnvironment = resolveDefaultDeployEnvironment(manifest);
-    const scope = { environment, defaultEnvironment };
-    if (target === "railway") {
-        setString(options, "railwayBin", stringFlag(parsed, "railway-bin"));
-        setString(options, "project", stringFlag(parsed, "railway-project") ?? env.RAILWAY_PROJECT_ID ?? jsonString(options.project));
-        setString(options, "service", stringFlag(parsed, "railway-service") ?? env.RAILWAY_SERVICE_ID ?? jsonString(options.service));
-        setBoolean(options, "json", flagBoolean(parsed, "railway-json"));
-        setBoolean(options, "detach", flagBoolean(parsed, "detach"));
+    const configured = manifest.gateway.deploy;
+    if (!configured || configured.kind !== target) {
+        throw new Error(`Deploy target ${target} is not selected by agent.md.`);
     }
-    else if (target === "docker") {
-        setString(options, "dockerBin", stringFlag(parsed, "docker-bin"));
-        setString(options, "image", stringFlag(parsed, "docker-image") ?? env.ASSEMBLY_LINE_DOCKER_IMAGE ?? jsonString(options.image));
-        const serve = flagBoolean(parsed, "serve") ?? flagBoolean(parsed, "run");
-        setBoolean(options, "serve", serve);
-        setNumber(options, "port", numberFlag(parsed, "port"));
-    }
-    else if (target === "fly") {
-        setString(options, "flyBin", stringFlag(parsed, "fly-bin"));
-        const explicitApp = stringFlag(parsed, "fly-app") ?? env.FLY_APP_NAME;
-        const manifestApp = jsonString(options.app);
-        setString(options, "app", explicitApp ?? (manifestApp ? environmentScopedName(manifestApp, scope) : undefined));
-        setString(options, "org", stringFlag(parsed, "fly-org") ?? env.FLY_ORG ?? jsonString(options.org));
-        setString(options, "region", stringFlag(parsed, "fly-region") ?? env.FLY_REGION ?? jsonString(options.region));
-        setString(options, "memory", stringFlag(parsed, "fly-memory"));
-        setString(options, "vmSize", stringFlag(parsed, "fly-vm-size"));
-        setNumber(options, "internalPort", numberFlag(parsed, "fly-internal-port"));
-        setBoolean(options, "detach", flagBoolean(parsed, "detach"));
-    }
-    else if (target === "vps") {
-        if (parsed.flags["vps-domain"] !== undefined) {
-            throw new Error("--vps-domain was removed. Configure the host ingress baseDomain in assembly-line.hosts.json.");
-        }
-        setString(options, "host", stringFlag(parsed, "vps-host") ?? jsonString(options.host));
-        setString(options, "hostsFile", stringFlag(parsed, "vps-hosts-file") ?? env.ASSEMBLY_LINE_VPS_HOSTS_FILE ?? jsonString(options.hostsFile));
+    const metadata = manifest.providerMetadata?.find((entry) => entry.role === "deploy" && entry.kind === target);
+    const options = { ...(configured.options ?? {}), cwd };
+    const scope = {
+        environment: resolveDeployEnvironment(manifest, parsed, env),
+        defaultEnvironment: resolveDefaultDeployEnvironment(manifest)
+    };
+    for (const name of metadata?.deployment?.environmentScopedOptions ?? []) {
+        const value = options[name];
+        if (typeof value === "string" && value.trim())
+            options[name] = environmentScopedName(value, scope);
     }
-    options.cwd = cwd;
+    const packageName = configured.packageName ?? metadata?.packageName;
     return {
-        kind: target,
+        ...configured,
         options,
-        ...(configured?.packageName ? { packageName: configured.packageName } : {})
+        ...(packageName ? { packageName } : {})
     };
 }
 export function resolveDeployEnvironment(manifest, parsed, env = process.env) {
@@ -60,27 +31,8 @@ export function resolveDeployEnvironment(manifest, parsed, env = process.env) {
         ?? (typeof configured === "string" ? configured : undefined)
         ?? "development";
 }
-/** The environment deploys land in when --env/ASSEMBLY_LINE_DEPLOY_ENV are absent. */
 export function resolveDefaultDeployEnvironment(manifest) {
     const configured = manifest.gateway.deploy?.options?.environment;
     return typeof configured === "string" ? configured : "development";
 }
-function flagBoolean(parsed, name) {
-    return parsed.flags[name] === undefined ? undefined : booleanFlag(parsed, name);
-}
-function jsonString(value) {
-    return typeof value === "string" ? value : undefined;
-}
-function setString(options, name, value) {
-    if (value !== undefined)
-        options[name] = value;
-}
-function setNumber(options, name, value) {
-    if (value !== undefined)
-        options[name] = value;
-}
-function setBoolean(options, name, value) {
-    if (value !== undefined)
-        options[name] = value;
-}
 //# sourceMappingURL=deploy-definition.js.map

package/dist/deploy-definition.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-definition.js","sourceRoot":"","sources":["../src/deploy-definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAAuB,EACvB,MAAc,EACd,MAAkB,EAClB,MAA0C,OAAO,CAAC,GAAG,EACrD,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,OAAO,GAAe,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;IAC/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;IACpE,MAAM,kBAAkB,GAAG,+BAA+B,CAAC,QAAQ,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAElD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QACpE,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9H,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,GAAG,CAAC,kBAAkB,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QAC9H,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;QACjE,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC/B,SAAS,CAAC,OAAO,EAAE,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAClE,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC,IAAI,GAAG,CAAC,0BAA0B,IAAI,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/H,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzE,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QACpC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;QAC5D,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC;QACtE,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5C,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAChH,SAAS,CAAC,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,GAAG,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACnG,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,GAAG,CAAC,UAAU,IAAI,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/G,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QAC/D,SAAS,CAAC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QAChE,SAAS,CAAC,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC,CAAC;QAC5E,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/D,CAAC;SAAM,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QAC5B,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CACb,8FAA8F,CAC/F,CAAC;QACJ,CAAC;QACD,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACvF,SAAS,CACP,OAAO,EACP,WAAW,EACX,UAAU,CAAC,MAAM,EAAE,gBAAgB,CAAC,IAAI,GAAG,CAAC,4BAA4B,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC;IAClB,OAAO;QACL,IAAI,EAAE,MAAM;QACZ,OAAO;QACP,GAAG,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAuB,EACvB,MAAkB,EAClB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;IACjE,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;WAC3B,GAAG,CAAC,wBAAwB;WAC5B,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;WACzD,aAAa,CAAC;AACrB,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,+BAA+B,CAAC,QAAuB;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;IACjE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;AACrE,CAAC;AAED,SAAS,WAAW,CAAC,MAAkB,EAAE,IAAY;IACnD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAyB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,SAAS,CAAC,OAAmB,EAAE,IAAY,EAAE,KAAyB;IAC7E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACjD,CAAC;AAED,SAAS,UAAU,CAAC,OAAmB,EAAE,IAAY,EAAE,KAA0B;IAC/E,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;AACjD,CAAC"}
+{"version":3,"file":"deploy-definition.js","sourceRoot":"","sources":["../src/deploy-definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,OAAO,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AAExD,6FAA6F;AAC7F,MAAM,UAAU,uBAAuB,CACrC,QAAuB,EACvB,MAAc,EACd,MAAkB,EAClB,MAA0C,OAAO,CAAC,GAAG,EACrD,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE;IAEnB,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,iBAAiB,MAAM,+BAA+B,CAAC,CAAC;IAC1E,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAe,EAAE,GAAG,CAAC,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG;QACZ,WAAW,EAAE,wBAAwB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC;QAC5D,kBAAkB,EAAE,+BAA+B,CAAC,QAAQ,CAAC;KAC9D,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,UAAU,EAAE,wBAAwB,IAAI,EAAE,EAAE,CAAC;QACxE,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,WAAW,GAAG,UAAU,CAAC,WAAW,IAAI,QAAQ,EAAE,WAAW,CAAC;IACpE,OAAO;QACL,GAAG,UAAU;QACb,OAAO;QACP,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,QAAuB,EACvB,MAAkB,EAClB,MAA0C,OAAO,CAAC,GAAG;IAErD,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;IACjE,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;WAC3B,GAAG,CAAC,wBAAwB;WAC5B,CAAC,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;WACzD,aAAa,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,+BAA+B,CAAC,QAAuB;IACrE,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC;IACjE,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC;AACrE,CAAC"}

package/dist/deploy-migrations.d.ts

@@ -0,0 +1,15 @@
+import type { BuildArtifact, DeploymentPlan } from "@assemblyline-agents/compiler";
+import type { DeployMigrationRequest } from "@assemblyline-agents/core";
+import { type ParsedArgs } from "./args.js";
+export declare function configuredMigrationRequest(artifact: BuildArtifact, parsed: ParsedArgs): DeployMigrationRequest;
+export declare function runConfiguredMigrations(artifact: BuildArtifact, plan: DeploymentPlan, request: DeployMigrationRequest): Promise<string>;
+export declare function runCommand(commandName: string, args: string[], options?: {
+    cwd?: string;
+    env?: NodeJS.ProcessEnv;
+    silent?: boolean;
+}): Promise<{
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}>;
+//# sourceMappingURL=deploy-migrations.d.ts.map

package/dist/deploy-migrations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-migrations.d.ts","sourceRoot":"","sources":["../src/deploy-migrations.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAc,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAExD,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,aAAa,EACvB,MAAM,EAAE,UAAU,GACjB,sBAAsB,CAOxB;AAED,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAED,wBAAgB,UAAU,CACxB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACxE,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA4B/D"}

package/dist/deploy-migrations.js

@@ -0,0 +1,72 @@
+import { spawn } from "node:child_process";
+import { existsSync, readdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { stringFlag } from "./args.js";
+export function configuredMigrationRequest(artifact, parsed) {
+    const entries = migrationEntriesForArtifact(artifact);
+    const command = stringFlag(parsed, "migration-command") ?? process.env.ASSEMBLY_LINE_MIGRATION_COMMAND;
+    if (entries.length > 0 && !command) {
+        throw new Error("Migration files are present, but no migration runner was configured. Pass --migration-command or set ASSEMBLY_LINE_MIGRATION_COMMAND.");
+    }
+    return { entries, ...(command ? { command } : {}) };
+}
+export async function runConfiguredMigrations(artifact, plan, request) {
+    const entries = request.entries;
+    if (entries.length === 0)
+        return "none";
+    const commandName = request.command;
+    console.log(`Running ${entries.length} migration file(s) with ${commandName}.`);
+    const result = await runCommand(commandName, [], {
+        cwd: artifact.root,
+        env: {
+            ...process.env,
+            ASSEMBLY_LINE_ARTIFACT_ROOT: artifact.root,
+            ASSEMBLY_LINE_AGENT_REVISION: plan.agentRevision,
+            ASSEMBLY_LINE_DEPLOY_ENV: plan.environment,
+            ASSEMBLY_LINE_MIGRATION_FILES: JSON.stringify(entries)
+        }
+    });
+    if (result.exitCode !== 0)
+        throw new Error(`Migration command failed with exit code ${result.exitCode}.`);
+    return `ran:${entries.length}`;
+}
+export function runCommand(commandName, args, options = {}) {
+    return new Promise((resolvePromise, reject) => {
+        const child = spawn(commandName, args, {
+            cwd: options.cwd ?? process.cwd(),
+            env: options.env ?? process.env,
+            stdio: ["ignore", "pipe", "pipe"]
+        });
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+            const text = chunk.toString("utf8");
+            stdout += text;
+            if (!options.silent)
+                process.stdout.write(text);
+        });
+        child.stderr.on("data", (chunk) => {
+            const text = chunk.toString("utf8");
+            stderr += text;
+            if (!options.silent)
+                process.stderr.write(text);
+        });
+        child.on("error", (error) => {
+            if (error.code === "ENOENT") {
+                reject(new Error(`${commandName} not found. Install it, or pass the matching --*-bin flag with the executable path.`));
+                return;
+            }
+            reject(error);
+        });
+        child.on("close", (code) => resolvePromise({ exitCode: code ?? 1, stdout, stderr }));
+    });
+}
+function migrationEntriesForArtifact(artifact) {
+    const migrationsDir = resolve(artifact.root, "migrations");
+    if (!existsSync(migrationsDir))
+        return [];
+    return readdirSync(migrationsDir)
+        .filter((entry) => entry !== "README.md" && !entry.startsWith("."))
+        .sort();
+}
+//# sourceMappingURL=deploy-migrations.js.map

package/dist/deploy-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-migrations.js","sourceRoot":"","sources":["../src/deploy-migrations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AAExD,MAAM,UAAU,0BAA0B,CACxC,QAAuB,EACvB,MAAkB;IAElB,MAAM,OAAO,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,mBAAmB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;IACvG,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,uIAAuI,CAAC,CAAC;IAC3J,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAuB,EACvB,IAAoB,EACpB,OAA+B;IAE/B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IACxC,MAAM,WAAW,GAAG,OAAO,CAAC,OAAQ,CAAC;IACrC,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,CAAC,MAAM,2BAA2B,WAAW,GAAG,CAAC,CAAC;IAChF,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,EAAE,EAAE,EAAE;QAC/C,GAAG,EAAE,QAAQ,CAAC,IAAI;QAClB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,2BAA2B,EAAE,QAAQ,CAAC,IAAI;YAC1C,4BAA4B,EAAE,IAAI,CAAC,aAAa;YAChD,wBAAwB,EAAE,IAAI,CAAC,WAAW;YAC1C,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SACvD;KACF,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1G,OAAO,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,WAAmB,EACnB,IAAc,EACd,UAAuE,EAAE;IAEzE,OAAO,IAAI,OAAO,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,EAAE;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE;YACrC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;YAC/B,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC;QACH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,IAAI,IAAI,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,WAAW,qFAAqF,CAAC,CAAC,CAAC;gBACvH,OAAO;YACT,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,2BAA2B,CAAC,QAAuB;IAC1D,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAC1C,OAAO,WAAW,CAAC,aAAa,CAAC;SAC9B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;SAClE,IAAI,EAAE,CAAC;AACZ,CAAC"}

package/dist/deploy-preflight.d.ts

@@ -0,0 +1,6 @@
+import type { BuildArtifact, DeploymentPlan } from "@assemblyline-agents/compiler";
+import type { AgentManifest, SandboxEnvironmentResolution } from "@assemblyline-agents/core";
+export declare function preflightChannelInstallations(artifact: BuildArtifact, deployEnv: NodeJS.ProcessEnv): Promise<void>;
+export declare function effectiveMissingRequirements(plan: DeploymentPlan, manifest: AgentManifest, reusableSandboxEnvironments?: Record<string, SandboxEnvironmentResolution>): DeploymentPlan["missingRequirements"];
+export declare function printDeployWarnings(plan: DeploymentPlan): void;
+//# sourceMappingURL=deploy-preflight.d.ts.map

package/dist/deploy-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-preflight.d.ts","sourceRoot":"","sources":["../src/deploy-preflight.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACnF,OAAO,KAAK,EAAE,aAAa,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAI7F,wBAAsB,6BAA6B,CACjD,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,MAAM,CAAC,UAAU,GAC3B,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,aAAa,EACvB,2BAA2B,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,GACzE,cAAc,CAAC,qBAAqB,CAAC,CAcvC;AAED,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,cAAc,GAAG,IAAI,CAI9D"}

package/dist/deploy-preflight.js

@@ -0,0 +1,40 @@
+import { AssemblyLineRuntime, loadRuntimeBundle } from "@assemblyline-agents/runtime";
+import { checkChannelInstallations } from "./channels.js";
+export async function preflightChannelInstallations(artifact, deployEnv) {
+    const runtime = new AssemblyLineRuntime({ ...loadRuntimeBundle(artifact.root), env: deployEnv });
+    const checks = await checkChannelInstallations(artifact.manifest, deployEnv, fetch, (channel) => runtime.loadCompiledChannelModule(channel));
+    for (const check of checks) {
+        const workspace = check.workspace ? ` (${check.workspace})` : "";
+        if (check.skipped) {
+            console.warn(`Channel preflight skipped for ${check.provider}${workspace}: ${check.detail}`);
+            continue;
+        }
+        if (!check.ok)
+            throw new Error(`Channel preflight failed for ${check.provider}${workspace}: ${check.detail}`);
+        console.log(`Channel preflight passed for ${check.provider}${workspace}.`);
+        if (check.missingOptionalScopes.length > 0) {
+            console.warn(`Optional ${check.provider} scopes not granted: ${check.missingOptionalScopes.join(", ")}.`);
+        }
+    }
+}
+export function effectiveMissingRequirements(plan, manifest, reusableSandboxEnvironments) {
+    let missing = plan.missingRequirements;
+    const deployMetadata = manifest.providerMetadata?.find((entry) => entry.kind === plan.target && entry.role === "deploy");
+    if (deployMetadata?.deployment?.remoteSecretValidation && !plan.dryRun) {
+        const sandboxKind = manifest.gateway.sandbox?.kind ?? "local";
+        const provisioningEnv = new Set(manifest.providerMetadata?.find((entry) => entry.kind === sandboxKind && entry.role === "sandbox")
+            ?.sandboxEnvironment?.provisioningEnv ?? []);
+        missing = missing.filter((requirement) => requirement.kind !== "env"
+            || requirement.adapter === plan.target
+            || (provisioningEnv.has(requirement.name) && !reusableSandboxEnvironments));
+    }
+    return missing;
+}
+export function printDeployWarnings(plan) {
+    if (plan.warnings.length === 0)
+        return;
+    console.warn("Deploy warnings:");
+    for (const warning of plan.warnings)
+        console.warn(`- ${warning.name}: ${warning.message}`);
+}
+//# sourceMappingURL=deploy-preflight.js.map

package/dist/deploy-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-preflight.js","sourceRoot":"","sources":["../src/deploy-preflight.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtF,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,QAAuB,EACvB,SAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,mBAAmB,CAAC,EAAE,GAAG,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAC5C,QAAQ,CAAC,QAAQ,EACjB,SAAS,EACT,KAAK,EACL,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,CACxD,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,iCAAiC,KAAK,CAAC,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC7F,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,KAAK,CAAC,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9G,OAAO,CAAC,GAAG,CAAC,gCAAgC,KAAK,CAAC,QAAQ,GAAG,SAAS,GAAG,CAAC,CAAC;QAC3E,IAAI,KAAK,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3C,OAAO,CAAC,IAAI,CAAC,YAAY,KAAK,CAAC,QAAQ,wBAAwB,KAAK,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC5G,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC1C,IAAoB,EACpB,QAAuB,EACvB,2BAA0E;IAE1E,IAAI,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC;IACvC,MAAM,cAAc,GAAG,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACzH,IAAI,cAAc,EAAE,UAAU,EAAE,sBAAsB,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC;QAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;YAChG,EAAE,kBAAkB,EAAE,eAAe,IAAI,EAAE,CAC9C,CAAC;QACF,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,KAAK;eAC/D,WAAW,CAAC,OAAO,KAAK,IAAI,CAAC,MAAM;eACnC,CAAC,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,IAAoB;IACtD,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACvC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACjC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAC7F,CAAC"}

package/dist/deploy-receipts.d.ts

@@ -0,0 +1,9 @@
+import type { BuildArtifact, DeploymentPlan } from "@assemblyline-agents/compiler";
+import { type ParsedArgs } from "./args.js";
+export declare function environmentReceiptPath(artifactRoot: string, environment: string): string;
+export declare function writeDeployReceipt(artifactRoot: string, plan: Pick<DeploymentPlan, "environment">, receipt: unknown): void;
+export declare function removeDeployReceipts(artifactRoot: string, plan: Pick<DeploymentPlan, "environment">): void;
+export declare function assertDestroyAllowed(plan: DeploymentPlan, parsed: ParsedArgs): void;
+export declare function localDeployReceipt(artifact: BuildArtifact, plan: DeploymentPlan, status: string, deploymentUrl: string | null): Record<string, unknown>;
+export declare function writeJson(path: string, value: unknown): void;
+//# sourceMappingURL=deploy-receipts.d.ts.map

package/dist/deploy-receipts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipts.d.ts","sourceRoot":"","sources":["../src/deploy-receipts.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEnF,OAAO,EAAe,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAEzD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAExF;AAED,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,EACzC,OAAO,EAAE,OAAO,GACf,IAAI,CAGN;AAED,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,aAAa,CAAC,GACxC,IAAI,CASN;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,GAAG,IAAI,CAMnF;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,aAAa,EACvB,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GAAG,IAAI,GAC3B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAWzB;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAG5D"}

package/dist/deploy-receipts.js

@@ -0,0 +1,45 @@
+import { mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { sanitizeDeployName } from "@assemblyline-agents/core";
+import { booleanFlag } from "./args.js";
+export function environmentReceiptPath(artifactRoot, environment) {
+    return resolve(artifactRoot, "deployments", `${sanitizeDeployName(environment)}.json`);
+}
+export function writeDeployReceipt(artifactRoot, plan, receipt) {
+    writeJson(environmentReceiptPath(artifactRoot, plan.environment), receipt);
+    writeJson(resolve(artifactRoot, "deployment.json"), receipt);
+}
+export function removeDeployReceipts(artifactRoot, plan) {
+    rmSync(environmentReceiptPath(artifactRoot, plan.environment), { force: true });
+    const legacyPath = resolve(artifactRoot, "deployment.json");
+    try {
+        const legacy = JSON.parse(readFileSync(legacyPath, "utf8"));
+        if (legacy.environment === plan.environment)
+            rmSync(legacyPath, { force: true });
+    }
+    catch {
+        // An absent or unreadable legacy mirror is not a deploy receipt.
+    }
+}
+export function assertDestroyAllowed(plan, parsed) {
+    if (plan.environment === plan.defaultEnvironment && !booleanFlag(parsed, "force")) {
+        throw new Error(`Refusing to destroy the default environment "${plan.environment}" without --force. Alternate environments (--env <name>) are presumed disposable; the default one is not.`);
+    }
+}
+export function localDeployReceipt(artifact, plan, status, deploymentUrl) {
+    return {
+        target: "local",
+        status,
+        environment: plan.environment,
+        agentRevision: plan.agentRevision,
+        buildRevision: plan.buildRevision ?? plan.agentRevision,
+        artifactRoot: artifact.root,
+        deploymentUrl,
+        completedAt: new Date().toISOString()
+    };
+}
+export function writeJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+//# sourceMappingURL=deploy-receipts.js.map

package/dist/deploy-receipts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-receipts.js","sourceRoot":"","sources":["../src/deploy-receipts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAE7C,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,WAAW,EAAmB,MAAM,WAAW,CAAC;AAEzD,MAAM,UAAU,sBAAsB,CAAC,YAAoB,EAAE,WAAmB;IAC9E,OAAO,OAAO,CAAC,YAAY,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,YAAoB,EACpB,IAAyC,EACzC,OAAgB;IAEhB,SAAS,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;IAC3E,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,EAAE,OAAO,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,YAAoB,EACpB,IAAyC;IAEzC,MAAM,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChF,MAAM,UAAU,GAAG,OAAO,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAA8B,CAAC;QACzF,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;YAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;IACnE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAoB,EAAE,MAAkB;IAC3E,IAAI,IAAI,CAAC,WAAW,KAAK,IAAI,CAAC,kBAAkB,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;QAClF,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,WAAW,2GAA2G,CAC5K,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAuB,EACvB,IAAoB,EACpB,MAAc,EACd,aAA4B;IAE5B,OAAO;QACL,MAAM,EAAE,OAAO;QACf,MAAM;QACN,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa;QACvD,YAAY,EAAE,QAAQ,CAAC,IAAI;QAC3B,aAAa;QACb,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAc;IACpD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/deploy-sandbox-environments.d.ts

@@ -0,0 +1,6 @@
+import type { BuildArtifact } from "@assemblyline-agents/compiler";
+import { type SandboxEnvironmentResolution } from "@assemblyline-agents/core";
+export declare function sandboxEnvironmentReconciler(artifact: BuildArtifact, deployEnv: NodeJS.ProcessEnv, reusableResolutions?: Record<string, SandboxEnvironmentResolution>): (() => Promise<Record<string, SandboxEnvironmentResolution>>) | undefined;
+export declare function reusableSandboxEnvironmentResolutions(artifact: Pick<BuildArtifact, "root" | "manifest">, environmentName: string): Record<string, SandboxEnvironmentResolution> | undefined;
+export declare function sandboxPassthroughEnv(env: NodeJS.ProcessEnv, names: string[]): Record<string, string>;
+//# sourceMappingURL=deploy-sandbox-environments.d.ts.map

package/dist/deploy-sandbox-environments.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-sandbox-environments.d.ts","sourceRoot":"","sources":["../src/deploy-sandbox-environments.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAA6B,KAAK,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AAKzG,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,MAAM,CAAC,UAAU,EAC5B,mBAAmB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,GACjE,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC,CAAC,GAAG,SAAS,CAkC3E;AAED,wBAAgB,qCAAqC,CACnD,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,GAAG,UAAU,CAAC,EAClD,eAAe,EAAE,MAAM,GACtB,MAAM,CAAC,MAAM,EAAE,4BAA4B,CAAC,GAAG,SAAS,CAsC1D;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWrG"}

package/dist/deploy-sandbox-environments.js

@@ -0,0 +1,109 @@
+import { readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isSensitiveSandboxEnvName } from "@assemblyline-agents/core";
+import { resolveProvider } from "@assemblyline-agents/node";
+import { environmentReceiptPath } from "./deploy-receipts.js";
+export function sandboxEnvironmentReconciler(artifact, deployEnv, reusableResolutions) {
+    const definition = artifact.manifest.gateway.sandbox;
+    if (!definition || definition.kind === "local")
+        return undefined;
+    const sandboxes = artifact.manifest.sandboxes.filter((candidate) => candidate.adapter === definition.kind && candidate.environment);
+    if (sandboxes.length === 0)
+        return undefined;
+    if (reusableResolutions)
+        return async () => reusableResolutions;
+    return async () => {
+        const provider = await resolveProvider("sandbox", definition, {
+            env: deployEnv,
+            fetch,
+            manifest: artifact.manifest,
+            artifactRoot: artifact.root,
+            providerRoot: fileURLToPath(new URL("..", import.meta.url)),
+            devMode: false
+        });
+        if (!provider.ensureEnvironment) {
+            throw new Error(`Sandbox provider ${definition.kind} cannot reconcile compiled environments.`);
+        }
+        const resolutions = {};
+        for (const sandbox of sandboxes) {
+            const environment = sandbox.environment;
+            if (!environment)
+                throw new Error(`Sandbox profile ${sandbox.name} has no compiled environment.`);
+            const passthroughEnv = sandboxPassthroughEnv(deployEnv, sandbox.env);
+            resolutions[sandbox.name] = await provider.ensureEnvironment({
+                agentId: artifact.manifest.agent.id ?? artifact.manifest.agent.name ?? "agent",
+                sandboxName: sandbox.name,
+                adapter: definition.kind,
+                artifactRoot: artifact.root,
+                environment,
+                ...(Object.keys(passthroughEnv).length > 0 ? { env: passthroughEnv } : {})
+            });
+        }
+        return resolutions;
+    };
+}
+export function reusableSandboxEnvironmentResolutions(artifact, environmentName) {
+    const definition = artifact.manifest.gateway.sandbox;
+    if (!definition || definition.kind === "local")
+        return undefined;
+    const sandboxes = artifact.manifest.sandboxes.filter((candidate) => candidate.adapter === definition.kind && candidate.environment);
+    if (sandboxes.length === 0)
+        return undefined;
+    const candidates = [
+        environmentReceiptPath(artifact.root, environmentName),
+        resolve(artifact.root, "deployment.json")
+    ];
+    for (const path of candidates) {
+        try {
+            const receipt = JSON.parse(readFileSync(path, "utf8"));
+            if (receipt.status !== "published" || receipt.environment !== environmentName)
+                continue;
+            const stored = receipt.sandboxEnvironments;
+            if (!stored || typeof stored !== "object" || Array.isArray(stored))
+                continue;
+            const resolutions = {};
+            let matches = true;
+            for (const sandbox of sandboxes) {
+                const fingerprint = sandbox.environment?.fingerprint;
+                const resolution = stored[sandbox.name];
+                if (!fingerprint
+                    || !isSandboxEnvironmentResolution(resolution)
+                    || resolution.provider !== definition.kind
+                    || resolution.fingerprint !== fingerprint) {
+                    matches = false;
+                    break;
+                }
+                resolutions[sandbox.name] = { ...resolution, action: "reused" };
+            }
+            if (matches)
+                return resolutions;
+        }
+        catch {
+            // Missing, stale, or malformed receipts are not reuse evidence.
+        }
+    }
+    return undefined;
+}
+export function sandboxPassthroughEnv(env, names) {
+    const values = {};
+    for (const name of names) {
+        const value = env[name];
+        if (value !== undefined)
+            values[name] = value;
+    }
+    const sensitive = Object.keys(values).filter(isSensitiveSandboxEnvName);
+    if (sensitive.length > 0) {
+        throw new Error(`Refusing host/control-plane secrets in sandbox profile env: ${sensitive.join(", ")}.`);
+    }
+    return values;
+}
+function isSandboxEnvironmentResolution(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const record = value;
+    return ["provider", "artifactKind", "fingerprint", "artifactId", "runtimeReference"]
+        .every((key) => typeof record[key] === "string" && record[key].length > 0)
+        && ["reused", "built", "external"].includes(String(record.action));
+}
+//# sourceMappingURL=deploy-sandbox-environments.js.map

package/dist/deploy-sandbox-environments.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-sandbox-environments.js","sourceRoot":"","sources":["../src/deploy-sandbox-environments.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,yBAAyB,EAAqC,MAAM,2BAA2B,CAAC;AACzG,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,UAAU,4BAA4B,CAC1C,QAAuB,EACvB,SAA4B,EAC5B,mBAAkE;IAElE,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC,WAAW,CAAC,CAAC;IACpI,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,IAAI,mBAAmB;QAAE,OAAO,KAAK,IAAI,EAAE,CAAC,mBAAmB,CAAC;IAChE,OAAO,KAAK,IAAI,EAAE;QAChB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAiB,SAAS,EAAE,UAAU,EAAE;YAC5E,GAAG,EAAE,SAAS;YACd,KAAK;YACL,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,YAAY,EAAE,QAAQ,CAAC,IAAI;YAC3B,YAAY,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC3D,OAAO,EAAE,KAAK;SACf,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,oBAAoB,UAAU,CAAC,IAAI,0CAA0C,CAAC,CAAC;QACjG,CAAC;QACD,MAAM,WAAW,GAAiD,EAAE,CAAC;QACrE,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;YACxC,IAAI,CAAC,WAAW;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,OAAO,CAAC,IAAI,+BAA+B,CAAC,CAAC;YAClG,MAAM,cAAc,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YACrE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,MAAM,QAAQ,CAAC,iBAAiB,CAAC;gBAC3D,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,IAAI,OAAO;gBAC9E,WAAW,EAAE,OAAO,CAAC,IAAI;gBACzB,OAAO,EAAE,UAAU,CAAC,IAAI;gBACxB,YAAY,EAAE,QAAQ,CAAC,IAAI;gBAC3B,WAAW;gBACX,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3E,CAAC,CAAC;QACL,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qCAAqC,CACnD,QAAkD,EAClD,eAAuB;IAEvB,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;IACrD,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACjE,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACjE,SAAS,CAAC,OAAO,KAAK,UAAU,CAAC,IAAI,IAAI,SAAS,CAAC,WAAW,CAC/D,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAE7C,MAAM,UAAU,GAAG;QACjB,sBAAsB,CAAC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;QACtD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;KAC1C,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC;YAClF,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,WAAW,KAAK,eAAe;gBAAE,SAAS;YACxF,MAAM,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;YAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,SAAS;YAC7E,MAAM,WAAW,GAAiD,EAAE,CAAC;YACrE,IAAI,OAAO,GAAG,IAAI,CAAC;YACnB,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;gBAChC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,WAAW,CAAC;gBACrD,MAAM,UAAU,GAAI,MAAkC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBACrE,IAAI,CAAC,WAAW;uBACX,CAAC,8BAA8B,CAAC,UAAU,CAAC;uBAC3C,UAAU,CAAC,QAAQ,KAAK,UAAU,CAAC,IAAI;uBACvC,UAAU,CAAC,WAAW,KAAK,WAAW,EAAE,CAAC;oBAC5C,OAAO,GAAG,KAAK,CAAC;oBAChB,MAAM;gBACR,CAAC;gBACD,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;YAClE,CAAC;YACD,IAAI,OAAO;gBAAE,OAAO,WAAW,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,gEAAgE;QAClE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAAsB,EAAE,KAAe;IAC3E,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAChD,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACxE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,+DAA+D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1G,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,8BAA8B,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CAAC,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,CAAC;SACjF,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;WACvE,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/dist/deploy-secrets.d.ts

@@ -0,0 +1,21 @@
+import { type DeploymentPlan } from "@assemblyline-agents/compiler";
+import type { AgentManifest, DeployPlan } from "@assemblyline-agents/core";
+import { type ParsedArgs } from "./args.js";
+export declare function resolveDeploySecretsEnv(manifest: AgentManifest, agentRoot: string, target: string): Promise<{
+    env: NodeJS.ProcessEnv;
+    storeNames: string[];
+}>;
+export declare function syncDeploySecretsIfRequested(publisher: {
+    target: string;
+    syncSecrets?(secrets: Record<string, string>, plan: DeployPlan): Promise<{
+        syncedKeys: string[];
+        skippedKeys: string[];
+    }>;
+}, plan: DeploymentPlan, parsed: ParsedArgs, deployEnv: NodeJS.ProcessEnv): Promise<void>;
+export declare function withDeclaredRuntimeEnv(fileSecrets: Record<string, string>, plan: DeploymentPlan, env: Record<string, string | undefined>): Record<string, string>;
+export declare function splitDeploySecrets(secrets: Record<string, string>, plan: Pick<DeploymentPlan, "target" | "requirements" | "storeHeldCredentials" | "committedConfig">): {
+    runtimeSecrets: Record<string, string>;
+    localDeployKeys: string[];
+    storeHeldKeys: string[];
+};
+//# sourceMappingURL=deploy-secrets.d.ts.map

package/dist/deploy-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-secrets.d.ts","sourceRoot":"","sources":["../src/deploy-secrets.ts"],"names":[],"mappings":"AAEA,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACjG,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE3E,OAAO,EAA2B,KAAK,UAAU,EAAE,MAAM,WAAW,CAAC;AAGrE,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,aAAa,EACvB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAU3D;AAED,wBAAsB,4BAA4B,CAChD,SAAS,EAAE;IACT,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAAC,WAAW,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3H,EACD,IAAI,EAAE,cAAc,EACpB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,MAAM,CAAC,UAAU,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAED,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,IAAI,EAAE,cAAc,EACpB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAWxB;AAED,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,cAAc,GAAG,sBAAsB,GAAG,iBAAiB,CAAC,GACjG;IAAE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAC;IAAC,aAAa,EAAE,MAAM,EAAE,CAAA;CAAE,CAuBhG"}

package/dist/deploy-secrets.js

@@ -0,0 +1,83 @@
+import { existsSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { deployTargetCredentialNames } from "@assemblyline-agents/compiler";
+import { createCredentialBoundary, resolveCredentialInventory } from "@assemblyline-agents/node";
+import { booleanFlag, stringFlag } from "./args.js";
+import { readEnvSecretsFile } from "./project-env.js";
+export async function resolveDeploySecretsEnv(manifest, agentRoot, target) {
+    const boundary = await createCredentialBoundary({
+        manifest,
+        env: process.env,
+        additionalCredentialNames: deployTargetCredentialNames(manifest, target),
+        artifactRoot: agentRoot,
+        providerRoot: fileURLToPath(new URL("..", import.meta.url)),
+        devMode: false
+    });
+    return resolveCredentialInventory(boundary);
+}
+export async function syncDeploySecretsIfRequested(publisher, plan, parsed, deployEnv) {
+    if (!booleanFlag(parsed, "sync-secrets"))
+        return;
+    if (!publisher.syncSecrets) {
+        console.warn(`Deploy target ${publisher.target} does not support secret sync; set variables on the target manually.`);
+        return;
+    }
+    const secretsPath = stringFlag(parsed, "secrets-from");
+    if (secretsPath && !existsSync(secretsPath)) {
+        throw new Error(`Secrets file not found: ${secretsPath}`);
+    }
+    const fileSecrets = secretsPath ? readEnvSecretsFile(secretsPath) : {};
+    const secrets = withDeclaredRuntimeEnv(fileSecrets, plan, deployEnv);
+    const { runtimeSecrets, localDeployKeys, storeHeldKeys } = splitDeploySecrets(secrets, plan);
+    if (localDeployKeys.length > 0) {
+        console.log(`Kept ${localDeployKeys.length} deploy credential(s) local: ${localDeployKeys.join(", ")}`);
+    }
+    if (storeHeldKeys.length > 0) {
+        console.log(`Left ${storeHeldKeys.length} credential(s) in the gateway secrets store (resolved just in time by the runtime broker, not synced): ${storeHeldKeys.join(", ")}`);
+    }
+    const receipt = await publisher.syncSecrets(runtimeSecrets, plan);
+    console.log(`Synced ${receipt.syncedKeys.length} secret(s) to ${publisher.target}: ${receipt.syncedKeys.join(", ") || "(none)"}`);
+    if (receipt.skippedKeys.length > 0) {
+        console.log(`Skipped ${receipt.skippedKeys.length} empty key(s): ${receipt.skippedKeys.join(", ")}`);
+    }
+}
+export function withDeclaredRuntimeEnv(fileSecrets, plan, env) {
+    const committedConfig = new Set(plan.committedConfig ?? []);
+    const secrets = Object.fromEntries(Object.entries(fileSecrets).filter(([name]) => !committedConfig.has(name)));
+    for (const requirement of plan.requirements) {
+        if (requirement.kind !== "env" || requirement.adapter === plan.target)
+            continue;
+        for (const key of [requirement.name, ...(requirement.alternatives ?? [])]) {
+            if (committedConfig.has(key))
+                continue;
+            if (env[key] !== undefined)
+                secrets[key] = env[key] ?? "";
+        }
+    }
+    return secrets;
+}
+export function splitDeploySecrets(secrets, plan) {
+    const storeHeld = new Set(plan.storeHeldCredentials ?? []);
+    const committedConfig = new Set(plan.committedConfig ?? []);
+    const deployKeys = new Set(plan.requirements
+        .filter((requirement) => requirement.kind === "env" && requirement.adapter === plan.target)
+        .flatMap((requirement) => [requirement.name, ...(requirement.alternatives ?? [])]));
+    const runtimeKeys = new Set(plan.requirements
+        .filter((requirement) => requirement.kind === "env" && requirement.adapter !== plan.target)
+        .flatMap((requirement) => [requirement.name, ...(requirement.alternatives ?? [])]));
+    const runtimeSecrets = {};
+    const localDeployKeys = [];
+    const storeHeldKeys = [];
+    for (const [key, value] of Object.entries(secrets)) {
+        if (committedConfig.has(key))
+            continue;
+        if (deployKeys.has(key) && !runtimeKeys.has(key))
+            localDeployKeys.push(key);
+        else if (storeHeld.has(key))
+            storeHeldKeys.push(key);
+        else
+            runtimeSecrets[key] = value;
+    }
+    return { runtimeSecrets, localDeployKeys, storeHeldKeys: storeHeldKeys.sort() };
+}
+//# sourceMappingURL=deploy-secrets.js.map