@cobinar/dalus 0.1.0

package/README.md

@@ -0,0 +1,158 @@
+# dalus
+
+A command-line deploy tool for Cobinar — the wrangler-equivalent for
+Edge Compute, Static Hosting, Object Storage, Document DB, and Vault.
+Doesn't talk to Cloudflare or implement any deploy mechanism of its own:
+every command here is a thin, scriptable front door to
+`cobinar-dashboard-worker`'s own REST API — the exact same endpoints the
+web dashboard calls. See that project's README for the full endpoint
+reference this is built on.
+
+**Status**: v1. Real and working end-to-end against a mock of the real
+API (27 passing scenarios — login, every resource kind, dependency
+ordering, idempotent re-runs, named environments, both JSONC and TOML
+config, and clean failure when not logged in) — not yet run against an
+actual deployed `cobinar-dashboard-worker`, since this was built without
+network access to one. The one thing worth a real smoke test before
+relying on this day to day.
+
+## Install
+
+```
+cd dalus
+npm install
+npm link   # makes the `dalus` command available globally
+```
+
+(Not published to npm — this is source you own and can change.)
+
+## Log in
+
+```
+dalus login --api-base https://worker.lobby.cobinar.com --token <your bearer token>
+```
+
+dalus doesn't implement Cobinar's own signup/login flow — that lives in
+`cobinar-developers-worker`, a separate system. This command stores a
+token you've already obtained from wherever that flow gives you one, the
+same way `gh auth login --with-token` accepts a token instead of
+reimplementing GitHub's own login. Omit `--api-base`/`--token` to be
+prompted instead. Credentials are stored in `~/.dalus/credentials.json`
+(mode 0600), never inside a project directory.
+
+`dalus login --whoami` shows what's currently stored (token
+redacted). `dalus login --logout` clears it.
+
+## Set up a project
+
+```
+dalus init
+```
+
+writes a starter `dalus.jsonc` with every resource kind commented out —
+uncomment and fill in what your project actually needs. See
+`dalus.jsonc`'s own comments for the full shape, or the example below.
+
+## Deploy
+
+```
+dalus forge                 # deploys everything in the config
+dalus forge --pages         # just the pages[] entries
+dalus forge --workers       # just the workers[] entries
+dalus forge --env staging   # deploys the [env.staging] block instead
+dalus forge --name my-api   # just the one resource with this name
+```
+
+`dalus forge` looks for `dalus.jsonc`, `dalus.toml`, or `dalus.json` in
+the current directory, in that order — first one found wins. A bare
+`dalus forge` deploys `storage`, `database`, and `vault` first, then
+`pages`, then `workers` last — not the order they're written in the
+config — since a worker's bindings reference a bucket or collection by
+name and need that resource to already exist. Passing specific
+`--pages`/`--workers`/etc. flags deploys just those kinds, in the order
+given; if you're deploying a worker with bindings in isolation (without
+its target resources already forged), you'll get a clear error naming
+exactly what's missing, not a confusing API failure.
+
+Every resource is **find-or-create by name**: running `forge` again
+against a project that's already deployed updates it in place rather
+than creating a duplicate. Bindings and secrets sync the same way —
+already-present bindings are left alone, secrets are always re-set
+(harmless if the value hasn't changed).
+
+### Example `dalus.jsonc`
+
+```jsonc
+{
+  "workers": [
+    { "name": "guestbook-api", "main": "./worker-service.js",
+      "bindings": [
+        { "name": "AVATARS", "type": "storage", "resource": "guestbook-avatars" },
+        { "name": "CONFIG", "type": "database", "resource": "guestbook_config" }
+      ],
+      "secrets": ["GROQ_API_KEY"] }
+  ],
+  "pages": [
+    { "name": "guestbook-site", "dir": "./pages" }
+  ],
+  "storage": [
+    { "name": "guestbook-avatars", "dir": "./avatars", "public": true }
+  ],
+  "database": [
+    { "name": "guestbook_config", "seed": "./config-seed.json" }
+  ],
+  "vault": [
+    { "name": "guestbook-entries", "rules": "./vault-rules.txt" }
+  ]
+}
+```
+
+(This is, deliberately, the exact shape of the Cobinar Guestbook demo
+from an earlier session — try pointing a `dalus.jsonc` at it.)
+
+### Secrets
+
+List secret **names** in config, never values — `dalus forge` resolves
+each one from an environment variable of the same name
+(`GROQ_API_KEY=sk-... dalus forge`), or prompts for it interactively if
+the variable isn't set. `--yes` skips the prompt and leaves unset
+secrets alone (for CI, where an interactive prompt would just hang).
+
+### Named environments
+
+```jsonc
+{
+  "workers": [ /* ... */ ],
+  "env": {
+    "staging": {
+      "workers": [ { "name": "my-api-staging", "main": "./worker.js" } ]
+    }
+  }
+}
+```
+
+`--env staging` uses `env.staging`'s lists **instead of** the top-level
+ones, per resource kind — not a deep merge. A resource kind the env
+block doesn't mention falls back to the top-level list for that kind
+only. Simpler than Wrangler's own merge behavior, on purpose: easy to
+predict exactly what a given `--env` run will touch just by reading that
+one block.
+
+## What's explicitly not here yet
+
+- **The custom config-language idea** from the original ask (a language
+  built specifically for this tool) — deferred by request; `dalus.jsonc`
+  today is just JSONC, `dalus.toml` is just TOML.
+- **SSL/TLS strictness flags** (`dalus --ssl/tls --1/2/3` or similar) —
+  also explicitly deferred; nothing here touches TLS configuration.
+- **Diffing/cleanup** — Pages and Storage uploads re-push every file in
+  the configured directory every run; a file removed locally isn't
+  removed remotely. Database seeding only ever adds documents (no
+  matching-and-updating). A `--clean` or `--sync` mode that reconciles
+  instead of just re-uploading would be the natural next step if that
+  gap turns out to matter in practice.
+- **`dalus forge --workers --env`** from the original examples — `--env`
+  works as a flag needing a value (`--env staging`); if what was meant
+  was `--env` as a bare toggle with different behavior, that's worth
+  clarifying, since this implementation treats it the same way whether
+  or not `--workers` is also passed.

package/bin/dalus.js

@@ -0,0 +1,60 @@
+#!/usr/bin/env node
+'use strict';
+
+const { loginCommand } = require('../src/commands/login');
+const { forgeCommand } = require('../src/commands/forge');
+const { initCommand } = require('../src/commands/init');
+
+const HELP = `dalus — deploy Cobinar projects from the command line
+
+Usage:
+  dalus login [--api-base <url>] [--token <token>]
+  dalus login --whoami
+  dalus login --logout
+  dalus init [--force]
+  dalus forge [--pages] [--workers] [--storage] [--database] [--vault]
+              [--env <name>] [--name <resourceName>] [--yes]
+
+  Bare "dalus forge" deploys every resource in dalus.jsonc / dalus.toml /
+  dalus.json found in the current directory. Passing one or more of
+  --pages/--workers/--storage/--database/--vault narrows it to just
+  those kinds. --env <name> deploys the [env.<name>] block instead of
+  the top-level config. --name <resourceName> deploys just the one
+  resource with that name. --yes skips interactive secret prompts
+  (secrets with no matching environment variable are left unset).
+
+Examples:
+  dalus forge --pages
+  dalus forge --workers --env staging
+  dalus forge
+`;
+
+async function main() {
+  const [, , command, ...args] = process.argv;
+
+  switch (command) {
+    case 'login':
+      await loginCommand(args);
+      break;
+    case 'forge':
+      await forgeCommand(args);
+      break;
+    case 'init':
+      initCommand(args);
+      break;
+    case '--help':
+    case '-h':
+    case undefined:
+      console.log(HELP);
+      break;
+    default:
+      console.error(`Unknown command: ${command}\n`);
+      console.log(HELP);
+      process.exitCode = 1;
+  }
+}
+
+main().catch((err) => {
+  console.error(err.message || err);
+  process.exitCode = 1;
+});

package/package.json

@@ -0,0 +1,18 @@
+{
+  "name": "@cobinar/dalus",
+  "version": "0.1.0",
+  "description": "Deploy Cobinar projects (Edge Compute, Static Hosting, Object Storage, Document DB, Vault) from the command line.",
+  "bin": {
+    "dalus": "./bin/dalus.js"
+  },
+  "main": "./src/index.js",
+  "type": "commonjs",
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "dependencies": {
+    "jsonc-parser": "^3.3.1",
+    "smol-toml": "^1.3.1"
+  },
+  "license": "MIT"
+}

package/src/api-client.js

@@ -0,0 +1,67 @@
+'use strict';
+// A thin client over cobinar-dashboard-worker's real REST API — every
+// call here hits an endpoint that already exists and is already used by
+// the dashboard itself (see that project's README for the full list).
+// dalus doesn't talk to Cloudflare directly and has no separate deploy
+// mechanism of its own; it's a scriptable front door to the same API the
+// web dashboard calls, nothing more.
+
+class DalusApiError extends Error {
+  constructor(message, status, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+  }
+}
+
+class ApiClient {
+  constructor({ apiBase, token }) {
+    if (!apiBase) throw new Error('apiBase is required (set it in your dalus config, or run "dalus login").');
+    if (!token) throw new Error('Not logged in — run "dalus login" first.');
+    this.apiBase = apiBase.replace(/\/$/, '');
+    this.token = token;
+  }
+
+  async request(method, path, { body, headers, rawBody } = {}) {
+    const res = await fetch(`${this.apiBase}${path}`, {
+      method,
+      headers: {
+        authorization: `Bearer ${this.token}`,
+        ...(body !== undefined ? { 'content-type': 'application/json' } : {}),
+        ...headers,
+      },
+      body: rawBody !== undefined ? rawBody : body !== undefined ? JSON.stringify(body) : undefined,
+    });
+    const text = await res.text();
+    let parsed;
+    try { parsed = text ? JSON.parse(text) : null; } catch { parsed = text; }
+    if (!res.ok) {
+      const message = (parsed && typeof parsed === 'object' && parsed.error) || `${method} ${path} failed with ${res.status}`;
+      throw new DalusApiError(message, res.status, parsed);
+    }
+    return parsed;
+  }
+
+  get(path) { return this.request('GET', path); }
+  post(path, body) { return this.request('POST', path, { body }); }
+  patch(path, body) { return this.request('PATCH', path, { body }); }
+  put(path, body) { return this.request('PUT', path, { body }); }
+  delete(path) { return this.request('DELETE', path); }
+  putRaw(path, rawBody, contentType) {
+    return this.request('PUT', path, { rawBody, headers: contentType ? { 'content-type': contentType } : undefined });
+  }
+
+  // ---- find-or-create helpers ----
+  // Every resource kind exposes a GET list + POST create, and every
+  // create schema 400s on a duplicate name scoped the way that resource
+  // scopes names (see each route file) — so "does this already exist"
+  // is answered by listing and matching on name, not a dedicated
+  // lookup-by-name endpoint (none of these APIs have one).
+
+  async findByName(listPath, name) {
+    const rows = await this.get(listPath);
+    return rows.find((r) => r.name === name) || null;
+  }
+}
+
+module.exports = { ApiClient, DalusApiError };

package/src/commands/forge.js

@@ -0,0 +1,104 @@
+'use strict';
+const { loadConfig, resolveEnv, loadCredentials } = require('../config');
+const { ApiClient } = require('../api-client');
+const { forgeWorker } = require('../forgers/workers');
+const { forgePages } = require('../forgers/pages');
+const { forgeStorage } = require('../forgers/storage');
+const { forgeDatabase } = require('../forgers/database');
+const { forgeVault } = require('../forgers/vault');
+
+const KIND_FLAGS = {
+  workers: '--workers',
+  pages: '--pages',
+  storage: '--storage',
+  database: '--database',
+  vault: '--vault',
+};
+const FORGERS = {
+  workers: (api, log, entry, opts) => forgeWorker(api, log, entry, opts),
+  pages: (api, log, entry) => forgePages(api, log, entry),
+  storage: (api, log, entry) => forgeStorage(api, log, entry),
+  database: (api, log, entry) => forgeDatabase(api, log, entry),
+  vault: (api, log, entry) => forgeVault(api, log, entry),
+};
+// Bare `dalus forge` (no kind flags) deploys every kind — in THIS order,
+// not object-key order: storage/database/vault/pages have no
+// dependencies on anything else in this list, while a worker's bindings
+// reference a storage bucket or Document DB collection by name and fail
+// with a clear "doesn't exist yet" error if that resource isn't already
+// forged. Deploying workers last means a bare `dalus forge` on a brand
+// new project just works, instead of depending on running it twice.
+const DEFAULT_KIND_ORDER = ['storage', 'database', 'vault', 'pages', 'workers'];
+
+function parseForgeArgs(args) {
+  const opts = { kinds: [], env: null, yes: args.includes('--yes'), only: null };
+  for (const [kind, flag] of Object.entries(KIND_FLAGS)) {
+    if (args.includes(flag)) opts.kinds.push(kind);
+  }
+  const envIdx = args.indexOf('--env');
+  if (envIdx !== -1) opts.env = args[envIdx + 1];
+  const onlyIdx = args.indexOf('--name');
+  if (onlyIdx !== -1) opts.only = args[onlyIdx + 1]; // deploy just the one resource with this name, across whichever kind(s) it's found under
+  return opts;
+}
+
+// `dalus forge` with no --pages/--workers/etc. deploys every resource
+// kind present in the config — bare `dalus forge` is meant to mean "ship
+// this whole project," matching the exact example in the original ask.
+// Naming one or more kind flags narrows it to just those.
+async function forgeCommand(args) {
+  const opts = parseForgeArgs(args);
+  const creds = loadCredentials();
+  if (!creds) {
+    console.error('Not logged in. Run "dalus login" first.');
+    process.exitCode = 1;
+    return;
+  }
+
+  let config;
+  try {
+    config = loadConfig();
+    if (opts.env) config = resolveEnv(config, opts.env);
+  } catch (err) {
+    console.error(err.message);
+    process.exitCode = 1;
+    return;
+  }
+
+  const api = new ApiClient({ apiBase: config.apiBase || creds.apiBase, token: creds.token });
+  const kindsToRun = opts.kinds.length > 0 ? opts.kinds : DEFAULT_KIND_ORDER;
+
+  const results = [];
+  for (const kind of kindsToRun) {
+    const entries = (config[kind] || []).filter((e) => !opts.only || e.name === opts.only);
+    for (const entry of entries) {
+      try {
+        await FORGERS[kind](api, (line) => console.log(line), entry, opts);
+        results.push({ kind, name: entry.name, ok: true });
+      } catch (err) {
+        console.error(`  FAILED: ${err.message}`);
+        results.push({ kind, name: entry.name, ok: false, error: err.message });
+      }
+      console.log('');
+    }
+  }
+
+  if (results.length === 0) {
+    console.log(
+      opts.kinds.length > 0
+        ? `No ${opts.kinds.join('/')} entries found in ${config.__configPath}.`
+        : `Nothing to deploy — ${config.__configPath} has no workers/pages/storage/database/vault entries.`,
+    );
+    return;
+  }
+
+  const failed = results.filter((r) => !r.ok);
+  console.log(`${results.length - failed.length}/${results.length} deployed successfully.`);
+  if (failed.length > 0) {
+    console.log('Failed:');
+    for (const f of failed) console.log(`  - ${f.kind} ${f.name}: ${f.error}`);
+    process.exitCode = 1;
+  }
+}
+
+module.exports = { forgeCommand };

package/src/commands/init.js

@@ -0,0 +1,53 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+const TEMPLATE = `{
+  // dalus config — see https://github.com/ (your Cobinar docs link here)
+  // for the full field reference. Paths below are relative to this file.
+
+  // Optional — if omitted, dalus uses whatever worker URL you logged in
+  // with ("dalus login"). Set this when a project should always deploy
+  // to a specific worker regardless of who's running "dalus forge".
+  // "apiBase": "https://worker.lobby.cobinar.com",
+
+  "workers": [
+    // { "name": "my-api", "main": "./worker.js",
+    //   "bindings": [
+    //     { "name": "MY_BUCKET", "type": "storage", "resource": "my-bucket" }
+    //   ],
+    //   "secrets": ["SOME_API_KEY"] }
+  ],
+  "pages": [
+    // { "name": "my-site", "dir": "./public" }
+  ],
+  "storage": [
+    // { "name": "my-bucket", "dir": "./assets", "public": true }
+  ],
+  "database": [
+    // { "name": "my_collection", "seed": "./seed.json" }
+  ],
+  "vault": [
+    // { "name": "my-vault", "rules": "./rules.txt" }
+  ]
+
+  // Named environments (optional) — "dalus forge --env staging" uses
+  // these instead of the top-level lists above, per resource kind:
+  // "env": {
+  //   "staging": { "workers": [ { "name": "my-api-staging", "main": "./worker.js" } ] }
+  // }
+}
+`;
+
+function initCommand(args) {
+  const target = path.join(process.cwd(), 'dalus.jsonc');
+  if (fs.existsSync(target) && !args.includes('--force')) {
+    console.error(`${target} already exists — pass --force to overwrite.`);
+    process.exitCode = 1;
+    return;
+  }
+  fs.writeFileSync(target, TEMPLATE);
+  console.log(`Created ${target}. Fill in the resources you want, then run "dalus forge".`);
+}
+
+module.exports = { initCommand };

package/src/commands/login.js

@@ -0,0 +1,54 @@
+'use strict';
+const readline = require('readline');
+const { saveCredentials, clearCredentials, loadCredentials, CREDENTIALS_PATH } = require('../config');
+
+function ask(question) {
+  return new Promise((resolve) => {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    rl.question(question, (answer) => { rl.close(); resolve(answer.trim()); });
+  });
+}
+
+// dalus does not implement Cobinar's own signup/login flow itself — that
+// lives in cobinar-developers-worker (a separate system) and issues the
+// bearer token the dashboard's browser session already uses. This
+// command just stores a token you've already obtained (from that flow,
+// wherever it prompts you for one) so dalus can send it on every
+// request, the same way `gh auth login --with-token` accepts a token
+// you got some other way rather than reimplementing GitHub's own login.
+async function loginCommand(args) {
+  if (args.includes('--logout')) {
+    clearCredentials();
+    console.log('Logged out.');
+    return;
+  }
+  if (args.includes('--whoami')) {
+    const creds = loadCredentials();
+    if (!creds) { console.log('Not logged in.'); return; }
+    console.log(`API base: ${creds.apiBase}`);
+    console.log(`Token:    ${creds.token.slice(0, 8)}...${creds.token.slice(-4)} (stored in ${CREDENTIALS_PATH})`);
+    return;
+  }
+
+  const apiBaseArgIdx = args.indexOf('--api-base');
+  const tokenArgIdx = args.indexOf('--token');
+  const apiBase = apiBaseArgIdx !== -1 ? args[apiBaseArgIdx + 1] : await ask('Cobinar dashboard-worker URL (e.g. https://worker.lobby.cobinar.com): ');
+  // Visible input, deliberately — Node's readline has no built-in masked
+  // prompt, and a hand-rolled no-echo hack is the kind of thing that's
+  // easy to get subtly wrong (garbled input, doesn't work across
+  // terminals) without a real TTY to test it against. --token on the
+  // command line, or piping the value in, avoids the prompt entirely if
+  // that matters more than a visible paste in a scrollback buffer.
+  const token = tokenArgIdx !== -1 ? args[tokenArgIdx + 1] : await ask('Bearer token (visible as you type/paste — see the note in README.md): ');
+
+  if (!apiBase || !token) {
+    console.error('Both a worker URL and a token are required.');
+    process.exitCode = 1;
+    return;
+  }
+
+  saveCredentials({ apiBase: apiBase.replace(/\/$/, ''), token });
+  console.log(`Saved to ${CREDENTIALS_PATH}. Run "dalus forge" from a project directory to deploy.`);
+}
+
+module.exports = { loginCommand };

package/src/config.js

@@ -0,0 +1,147 @@
+'use strict';
+// Config discovery and credential storage for dalus.
+//
+// Project config: dalus.jsonc, dalus.toml, or dalus.json, checked in the
+// current directory in that order (first one found wins — this is the
+// exact order named in the original ask: "look for file named
+// dalus.jsonc, dalus.toml, or dalus."). Login credentials are kept
+// entirely separate, in ~/.dalus/credentials.json, same reasoning
+// Wrangler keeps its own auth out of the project directory: a project
+// config is something you'd commit; a bearer token is not.
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const toml = require('smol-toml');
+const jsonc = require('jsonc-parser');
+
+const CONFIG_FILENAMES = ['dalus.jsonc', 'dalus.toml', 'dalus.json'];
+const CREDENTIALS_DIR = path.join(os.homedir(), '.dalus');
+const CREDENTIALS_PATH = path.join(CREDENTIALS_DIR, 'credentials.json');
+
+class DalusConfigError extends Error {}
+
+/** Searches the given directory (default: cwd) for a dalus config file,
+ * in the fixed priority order above. Returns { path, format } or null if
+ * none exist — forge.js decides what "none found" means for the command
+ * being run, this module just reports the fact. */
+function findConfigFile(dir = process.cwd()) {
+  for (const name of CONFIG_FILENAMES) {
+    const p = path.join(dir, name);
+    if (fs.existsSync(p)) {
+      return { path: p, format: path.extname(name).slice(1) };
+    }
+  }
+  return null;
+}
+
+/** Loads and parses whichever config file is found, resolving `dir`/
+ * `main`/`rules`/`seed` fields in every resource entry to absolute paths
+ * relative to the config file's own directory — so a project's resource
+ * definitions keep working regardless of what directory `dalus forge`
+ * happens to be invoked from. */
+function loadConfig(dir = process.cwd()) {
+  const found = findConfigFile(dir);
+  if (!found) {
+    throw new DalusConfigError(
+      `No dalus.jsonc, dalus.toml, or dalus.json found in ${dir}.\nRun "dalus init" to create one, or pass --pages/--workers/etc. with the other required flags directly.`,
+    );
+  }
+  const raw = fs.readFileSync(found.path, 'utf8');
+  let parsed;
+  try {
+    if (found.format === 'toml') {
+      parsed = toml.parse(raw);
+    } else {
+      const errors = [];
+      parsed = jsonc.parse(raw, errors, { allowTrailingComma: true });
+      if (errors.length > 0) {
+        throw new DalusConfigError(`Could not parse ${found.path}: ${jsonc.printParseErrorCode(errors[0].error)} near offset ${errors[0].offset}`);
+      }
+    }
+  } catch (err) {
+    if (err instanceof DalusConfigError) throw err;
+    throw new DalusConfigError(`Could not parse ${found.path}: ${err.message}`);
+  }
+
+  const baseDir = path.dirname(found.path);
+  const resolvePathFields = (entry, fields) => {
+    const out = { ...entry };
+    for (const f of fields) {
+      if (typeof out[f] === 'string') out[f] = path.resolve(baseDir, out[f]);
+    }
+    return out;
+  };
+
+  const resourceKinds = {
+    workers: ['main'],
+    pages: ['dir'],
+    storage: ['dir'],
+    database: ['seed'],
+    vault: ['rules'],
+  };
+  const normalized = { apiBase: parsed.apiBase, env: {} };
+  for (const kind of Object.keys(resourceKinds)) {
+    normalized[kind] = (parsed[kind] || []).map((e) => resolvePathFields(e, resourceKinds[kind]));
+  }
+  if (parsed.env && typeof parsed.env === 'object') {
+    for (const envName of Object.keys(parsed.env)) {
+      const envBlock = parsed.env[envName] || {};
+      normalized.env[envName] = {};
+      for (const kind of Object.keys(resourceKinds)) {
+        normalized.env[envName][kind] = (envBlock[kind] || []).map((e) => resolvePathFields(e, resourceKinds[kind]));
+      }
+    }
+  }
+  normalized.__configPath = found.path;
+  return normalized;
+}
+
+/** Applies `--env NAME`, if given: for each resource kind, an env block
+ * that defines that kind REPLACES the top-level list for it; a resource
+ * kind the env block doesn't mention falls back to the top-level list.
+ * This is a deliberately simpler model than Wrangler's deep-merge — easy
+ * to explain, easy to predict what a given --env will actually deploy. */
+function resolveEnv(config, envName) {
+  if (!envName) return config;
+  const envBlock = config.env && config.env[envName];
+  if (!envBlock) {
+    throw new DalusConfigError(`No [env.${envName}] block in ${config.__configPath}.`);
+  }
+  const merged = { ...config };
+  for (const kind of ['workers', 'pages', 'storage', 'database', 'vault']) {
+    if (envBlock[kind] && envBlock[kind].length > 0) merged[kind] = envBlock[kind];
+  }
+  return merged;
+}
+
+function loadCredentials() {
+  if (!fs.existsSync(CREDENTIALS_PATH)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(CREDENTIALS_PATH, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function saveCredentials(creds) {
+  fs.mkdirSync(CREDENTIALS_DIR, { recursive: true });
+  // Same-user-only permissions — this file holds a real bearer token.
+  fs.writeFileSync(CREDENTIALS_PATH, JSON.stringify(creds, null, 2), { mode: 0o600 });
+}
+
+function clearCredentials() {
+  if (fs.existsSync(CREDENTIALS_PATH)) fs.unlinkSync(CREDENTIALS_PATH);
+}
+
+module.exports = {
+  DalusConfigError,
+  CONFIG_FILENAMES,
+  CREDENTIALS_PATH,
+  findConfigFile,
+  loadConfig,
+  resolveEnv,
+  loadCredentials,
+  saveCredentials,
+  clearCredentials,
+};

package/src/forgers/database.js

@@ -0,0 +1,34 @@
+'use strict';
+const fs = require('fs');
+
+/** Deploys one Document DB collection: find-or-create by name, then
+ * optionally seeds it from a local JSON file (a single object -> one
+ * document, an array -> one document per entry). Seeding only ever
+ * ADDS documents — it doesn't diff against or replace what's already in
+ * the collection, so re-running against a collection that already has
+ * the seed data creates duplicates. Fine for "seed a fresh collection
+ * once"; a real sync mode (matching on some key field) would need this
+ * project's documents to have a stable id convention to match against,
+ * which isn't assumed here. */
+async function forgeDatabase(api, log, entry) {
+  log(`Document DB: ${entry.name}`);
+
+  let collection = await api.findByName('/database/collections', entry.name);
+  if (!collection) {
+    log(`  creating collection...`);
+    collection = await api.post('/database/collections', { name: entry.name });
+  }
+
+  if (entry.seed) {
+    const raw = JSON.parse(fs.readFileSync(entry.seed, 'utf8'));
+    const docs = Array.isArray(raw) ? raw : [raw];
+    for (const doc of docs) {
+      await api.post(`/database/collections/${collection.id}/documents`, doc);
+    }
+    log(`  seeded ${docs.length} document${docs.length === 1 ? '' : 's'} from ${entry.seed}`);
+  }
+
+  log(`  done`);
+}
+
+module.exports = { forgeDatabase };

package/src/forgers/pages.js

@@ -0,0 +1,35 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { walkFiles, guessContentType } = require('../fs-utils');
+
+/** Deploys one Static Hosting project: find-or-create by name, then PUT
+ * every file under `dir`. Uploads are NOT diffed against what's already
+ * there — every file in `dir` is re-uploaded every run, matching how
+ * `wrangler pages deploy` treats a deploy as a fresh snapshot rather
+ * than an incremental sync. Stale files left over from a previous
+ * deploy (renamed/removed locally) are not currently cleaned up — worth
+ * a `--clean` flag later if that turns out to matter in practice. */
+async function forgePages(api, log, entry) {
+  log(`Static Hosting: ${entry.name}`);
+  const files = walkFiles(entry.dir);
+  if (files.length === 0) throw new Error(`No files found in ${entry.dir}`);
+
+  let project = await api.findByName('/pages/projects', entry.name);
+  if (!project) {
+    log(`  creating project...`);
+    project = await api.post('/pages/projects', { name: entry.name });
+  }
+
+  for (const relPath of files) {
+    const fullPath = path.join(entry.dir, relPath);
+    const contentType = guessContentType(relPath);
+    const body = fs.readFileSync(fullPath);
+    await api.putRaw(`/pages/projects/${project.id}/files/${relPath}`, body, contentType);
+    log(`  uploaded ${relPath} (${contentType})`);
+  }
+
+  log(`  done -> ${project.liveUrl || project.fallbackUrl || '(live link not returned by the API)'}`);
+}
+
+module.exports = { forgePages };

package/src/forgers/storage.js

@@ -0,0 +1,39 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+const { walkFiles, guessContentType } = require('../fs-utils');
+
+/** Deploys one Object Storage bucket: find-or-create by name, flips
+ * public access if configured, then PUTs every file under `dir` as an
+ * object keyed by its relative path — same "re-upload everything every
+ * run" behavior as the Pages forger, for the same reason (matching a
+ * deploy tool's usual "this directory IS the desired state" model). */
+async function forgeStorage(api, log, entry) {
+  log(`Object Storage: ${entry.name}`);
+
+  let bucket = await api.findByName('/storage/buckets', entry.name);
+  if (!bucket) {
+    log(`  creating bucket...`);
+    bucket = await api.post('/storage/buckets', { name: entry.name });
+  }
+
+  if (typeof entry.public === 'boolean' && entry.public !== bucket.publicEnabled) {
+    bucket = await api.patch(`/storage/buckets/${bucket.id}/public`, { enabled: entry.public });
+    log(`  public access -> ${entry.public}`);
+  }
+
+  if (entry.dir) {
+    const files = walkFiles(entry.dir);
+    for (const relPath of files) {
+      const fullPath = path.join(entry.dir, relPath);
+      const contentType = guessContentType(relPath);
+      const body = fs.readFileSync(fullPath);
+      const result = await api.putRaw(`/storage/buckets/${bucket.id}/objects/${relPath}`, body, contentType);
+      log(`  uploaded ${relPath}${result && result.url ? ` -> ${result.url}` : ''}`);
+    }
+  }
+
+  log(`  done`);
+}
+
+module.exports = { forgeStorage };

package/src/forgers/vault.js

@@ -0,0 +1,27 @@
+'use strict';
+const fs = require('fs');
+
+/** Deploys one Vault: find-or-create by name, then uploads its rules
+ * text if configured. Rules are validated server-side (a real parse —
+ * see lib/rules.ts in the worker project) before being saved, so a
+ * syntax error in the local rules file surfaces here as a clear error,
+ * not a silent deploy of broken rules. */
+async function forgeVault(api, log, entry) {
+  log(`Vault: ${entry.name}`);
+
+  let vault = await api.findByName('/vaults', entry.name);
+  if (!vault) {
+    log(`  creating vault...`);
+    vault = await api.post('/vaults', { name: entry.name });
+  }
+
+  if (entry.rules) {
+    const rules = fs.readFileSync(entry.rules, 'utf8');
+    await api.put(`/vaults/${vault.id}/rules`, { rules });
+    log(`  rules uploaded from ${entry.rules}`);
+  }
+
+  log(`  done -> data endpoint at ${vault.dataUrl || `${api.apiBase}/vault/${entry.name}`}`);
+}
+
+module.exports = { forgeVault };

package/src/forgers/workers.js

@@ -0,0 +1,85 @@
+'use strict';
+const fs = require('fs');
+const readline = require('readline');
+
+function prompt(question) {
+  const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+  return new Promise((resolve) => rl.question(question, (answer) => { rl.close(); resolve(answer); }));
+}
+
+/** Resolves { name, type: 'storage'|'database', resource } bindings from
+ * config into the { resourceId } shape the API wants, by name-matching
+ * against the owner's existing buckets/collections — bindings reference
+ * resources by NAME in dalus config (portable across accounts/environments),
+ * but the API itself keys them by id. */
+async function resolveBindingResourceId(api, binding) {
+  const listPath = binding.type === 'storage' ? '/storage/buckets' : '/database/collections';
+  const kindLabel = binding.type === 'storage' ? 'storage bucket' : 'Document DB collection';
+  const found = await api.findByName(listPath, binding.resource);
+  if (!found) {
+    throw new Error(`Binding "${binding.name}" references ${kindLabel} "${binding.resource}", which doesn't exist yet — forge that resource first (dalus forge --storage or --database).`);
+  }
+  return found.id;
+}
+
+async function syncBindings(api, log, serviceId, bindingsConfig) {
+  if (!bindingsConfig || bindingsConfig.length === 0) return;
+  const existing = await api.get(`/services/${serviceId}/bindings`);
+  for (const binding of bindingsConfig) {
+    if (existing.some((e) => e.bindingName === binding.name)) {
+      log(`    binding ${binding.name} already exists, skipping`);
+      continue;
+    }
+    const resourceId = await resolveBindingResourceId(api, binding);
+    await api.post(`/services/${serviceId}/bindings`, {
+      bindingName: binding.name,
+      resourceType: binding.type,
+      resourceId,
+      canWrite: !!binding.canWrite,
+    });
+    log(`    bound env.${binding.name} -> ${binding.type}:${binding.resource}${binding.canWrite ? ' (read/write)' : ''}`);
+  }
+}
+
+async function syncSecrets(api, log, serviceId, secretNames, { yes }) {
+  if (!secretNames || secretNames.length === 0) return;
+  for (const name of secretNames) {
+    let value = process.env[name];
+    if (!value) {
+      if (yes) {
+        log(`    skipping secret ${name} (no ${name} env var set, and --yes disables prompting)`);
+        continue;
+      }
+      value = await prompt(`    Enter value for secret ${name} (or press Enter to skip): `);
+      if (!value) { log(`    skipped ${name}`); continue; }
+    }
+    await api.post(`/services/${serviceId}/secrets`, { name, value });
+    log(`    set secret env.${name}`);
+  }
+}
+
+/** Deploys one Edge Compute service: find-or-create by name, upload its
+ * code, then sync bindings and secrets. Bindings/secrets are synced
+ * every run (idempotent — see syncBindings/syncSecrets above); the code
+ * upload always overwrites, same as `wrangler deploy` always overwriting
+ * a Worker's script. */
+async function forgeWorker(api, log, entry, opts) {
+  log(`Edge Compute: ${entry.name}`);
+  if (!fs.existsSync(entry.main)) throw new Error(`main file not found: ${entry.main}`);
+  const code = fs.readFileSync(entry.main, 'utf8');
+
+  let svc = await api.findByName('/services', entry.name);
+  if (!svc) {
+    log(`  creating service...`);
+    svc = await api.post('/services', { name: entry.name });
+  }
+  await api.put(`/services/${svc.id}/code`, { code });
+  log(`  code uploaded (${code.length} bytes)`);
+
+  await syncBindings(api, log, svc.id, entry.bindings);
+  await syncSecrets(api, log, svc.id, entry.secrets, opts);
+
+  log(`  done -> test at ${api.apiBase}/run/${entry.name}`);
+}
+
+module.exports = { forgeWorker };

package/src/fs-utils.js

@@ -0,0 +1,36 @@
+'use strict';
+const fs = require('fs');
+const path = require('path');
+
+/** Recursively lists every file under `dir`, returning paths relative to
+ * `dir` with forward slashes (matching how the dashboard itself stores
+ * Pages/Storage keys) — regardless of the host OS's own separator. */
+function walkFiles(dir) {
+  const out = [];
+  const walk = (current) => {
+    for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+      if (entry.name.startsWith('.')) continue; // .git, .DS_Store, etc.
+      const full = path.join(current, entry.name);
+      if (entry.isDirectory()) walk(full);
+      else out.push(path.relative(dir, full).split(path.sep).join('/'));
+    }
+  };
+  if (!fs.existsSync(dir)) throw new Error(`Directory not found: ${dir}`);
+  walk(dir);
+  return out;
+}
+
+const EXT_TO_CONTENT_TYPE = {
+  html: 'text/html', htm: 'text/html', css: 'text/css', js: 'application/javascript',
+  mjs: 'application/javascript', json: 'application/json', svg: 'image/svg+xml',
+  png: 'image/png', jpg: 'image/jpeg', jpeg: 'image/jpeg', gif: 'image/gif',
+  webp: 'image/webp', ico: 'image/x-icon', txt: 'text/plain', md: 'text/markdown',
+  xml: 'application/xml', pdf: 'application/pdf', woff: 'font/woff', woff2: 'font/woff2',
+};
+
+function guessContentType(filePath) {
+  const ext = path.extname(filePath).slice(1).toLowerCase();
+  return EXT_TO_CONTENT_TYPE[ext] || 'application/octet-stream';
+}
+
+module.exports = { walkFiles, guessContentType };