@grayspar/cli 0.0.0-stage → 0.0.2

package/dist/commands/deploy/deploy-flags.js

@@ -0,0 +1,60 @@
+import { CliError } from '../../lib/errors.js';
+const EXAMPLE_VALUE = {
+    '--path': '/api',
+    '--dockerfile': 'docker/Dockerfile',
+    '--volume': '/app/data',
+};
+export const NO_PATH_VALUE = 'none';
+function servicePairs(values, flag, onlyServices) {
+    return values.map((value) => {
+        const separatorIndex = value.indexOf('=');
+        if (separatorIndex < 1) {
+            throw new CliError('bad_flag', `Write ${flag} as a service and a value, like ${flag} backend=${EXAMPLE_VALUE[flag]}.`, flag);
+        }
+        const name = value.slice(0, separatorIndex);
+        if (onlyServices.length > 0 && !onlyServices.includes(name)) {
+            throw new CliError('bad_flag', `${flag} ${value} is for ${name}, which --service leaves out. Add --service ${name}.`, '--service');
+        }
+        return [name, value.slice(separatorIndex + 1)];
+    });
+}
+export function parseDeployFlags(flags) {
+    const volumes = new Map();
+    for (const [name, path] of servicePairs(flags.volumes, '--volume', flags.services)) {
+        if (volumes.has(name)) {
+            throw new CliError('bad_flag', `A service keeps one volume. Give --volume once for ${name}.`, '--volume');
+        }
+        volumes.set(name, path);
+    }
+    return {
+        onlyServices: flags.services,
+        paths: new Map(servicePairs(flags.paths, '--path', flags.services)),
+        dockerfiles: new Map(servicePairs(flags.dockerfiles, '--dockerfile', flags.services)),
+        volumes,
+    };
+}
+export function servicesToSend(found, serviceFlags) {
+    const deploying = serviceFlags.onlyServices.length > 0
+        ? serviceFlags.onlyServices
+        : [
+            ...new Set([
+                ...found,
+                ...serviceFlags.paths.keys(),
+                ...serviceFlags.dockerfiles.keys(),
+                ...serviceFlags.volumes.keys(),
+            ]),
+        ];
+    return deploying.map((name) => {
+        const pathPrefix = serviceFlags.paths.get(name);
+        const dockerfile = serviceFlags.dockerfiles.get(name);
+        const volume = serviceFlags.volumes.get(name);
+        return {
+            name,
+            ...(pathPrefix === undefined
+                ? {}
+                : { pathPrefix: pathPrefix === NO_PATH_VALUE ? null : pathPrefix }),
+            ...(dockerfile === undefined ? {} : { dockerfile }),
+            ...(volume === undefined ? {} : { volume }),
+        };
+    });
+}

package/dist/commands/deploy/deploy-target.js

@@ -0,0 +1,19 @@
+/* The project folder is the linked one found from where the command runs, or the current folder when nothing is
+   linked. A folder given to deploy narrows the upload to the files under it, which keep their place in that folder. */
+import { stat } from 'node:fs/promises';
+import { isAbsolute, relative, resolve } from 'node:path';
+import { CliError } from '../../lib/errors.js';
+import { findLink } from '../../lib/project-link.js';
+export async function deployTarget(currentFolder, folder) {
+    const link = await findLink(currentFolder);
+    const root = link?.folder ?? resolve(currentFolder);
+    const wanted = resolve(currentFolder, folder);
+    const under = relative(root, wanted) || '.';
+    if (under === '..' || under.startsWith('../') || isAbsolute(under)) {
+        throw new CliError('outside_project', `${folder} is outside the project folder ${root}.\nRun grayspar deploy from inside the project folder.`);
+    }
+    const isFolder = await stat(wanted).then((found) => found.isDirectory(), () => false);
+    if (!isFolder)
+        throw new CliError('no_such_folder', `${folder} isn't a folder.`);
+    return { link, root, under };
+}

package/dist/commands/deploy/deploy.js

@@ -0,0 +1,209 @@
+/* Upload the project, send the deploy and follow it until it is live or has failed. */
+import { openAsBlob, rmSync } from 'node:fs';
+import { mkdtemp, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Command, Option } from 'commander';
+import { dataOrThrow, signedInClient } from '../../lib/client.js';
+import { collectRepeatedValue, commandAction } from '../../lib/command-helpers.js';
+import { CliError } from '../../lib/errors.js';
+import { awaitDeployment, printDeployFailure, printReplacedDeploy, } from '../../lib/follow-deployment.js';
+import { startProgress } from '../../lib/output.js';
+import { writeLink } from '../../lib/project-link.js';
+import { CTRL_C_EXIT_CODE } from '../../lib/prompt.js';
+import { commandFor } from '../../lib/resolve-project.js';
+import { servicesTable } from '../../lib/services-table.js';
+import { color, receipt, table, warning } from '../../lib/ui.js';
+import { archiveOf } from './archive.js';
+import { awaitDiscovery } from './await-discovery.js';
+import { destinationFor } from './deploy-destination.js';
+import { NO_PATH_VALUE, parseDeployFlags, servicesToSend, } from './deploy-flags.js';
+import { deployTarget } from './deploy-target.js';
+import { emptyFoundVariables, variablesFor } from './env-files.js';
+import { gitStateOf } from './git-state.js';
+import { submitDeploy } from './submit-deploy.js';
+import { variablesToSend } from './variables-to-send.js';
+const UPLOAD_TIMEOUT_MS = 30 * 60 * 1000;
+async function deploy(folder, options) {
+    const { link, root, under } = await deployTarget(process.cwd(), folder);
+    const serviceFlags = parseDeployFlags(options.flags);
+    const api = await signedInClient();
+    const destination = await destinationFor(api, root, link, options);
+    const inspecting = startProgress(options.format, 'Inspecting your project…');
+    const uploaded = await uploadSource(api, destination, { root, under }, inspecting).finally(inspecting.stop);
+    const variables = new Map(await Promise.all(uploaded.services.map(async (service) => [
+        service.name,
+        options.env
+            ? await variablesFor(root, service.rootFolder, uploaded.platformVariables, options.envFile)
+            : emptyFoundVariables(),
+    ])));
+    if (options.format === 'text')
+        printFoundServices(uploaded, variables, under === '.');
+    const foundNames = uploaded.services.map((service) => service.name);
+    const deploying = servicesToSend(foundNames, serviceFlags).flatMap(({ name }) => {
+        const known = variables.get(name);
+        return known === undefined ? [] : [{ name, foundVariables: known }];
+    });
+    const chosen = await variablesToSend(api, destination.kind === 'project' ? destination.project : null, root, deploying.map((service) => service.name), deploying.map((service) => service.foundVariables), options.envConflict, {
+        projectName: destination.kind === 'project' ? destination.project.name : destination.name,
+        format: options.format,
+        yes: options.yes,
+    });
+    const { project, deployment } = await submitDeploy(api, destination, options, serviceFlags, foundNames, { upload: uploaded.upload, variables: chosen.variables });
+    if (destination.kind === 'new' || destination.linksFolder) {
+        await writeLink(root, { projectId: project.id });
+    }
+    if (options.format === 'text') {
+        for (const { service, addedVolume } of deployment.services) {
+            if (addedVolume === null)
+                continue;
+            process.stdout.write(`${receipt(`Added volume ${addedVolume} to ${service}`)}\n`);
+        }
+    }
+    const outcome = await watchDeployment(api, project, deployment.id, options.format);
+    if (options.format === 'json') {
+        const variables = {
+            sent: Object.entries(chosen.variables).flatMap(([service, values]) => Object.keys(values).map((key) => ({ service, key }))),
+            leftOut: chosen.leftOut.map(({ service, key }) => ({ service, key })),
+        };
+        process.stdout.write(`${JSON.stringify({ project: project.name, url: project.url, variables, ...outcome }, null, 2)}\n`);
+        if (outcome.status !== 'live')
+            process.exitCode = 1;
+        return;
+    }
+    await printOutcome(api, project, outcome);
+}
+async function uploadLimitsOf(api, destination) {
+    if (destination.kind === 'new')
+        return destination.team.uploadLimits;
+    const teams = await dataOrThrow(api.GET('/api/teams'));
+    const team = teams.find((candidate) => candidate.id === destination.project.teamId);
+    if (team === undefined)
+        throw new Error(`team ${destination.project.teamId} is not in /api/teams`);
+    return team.uploadLimits;
+}
+async function uploadSource(api, destination, source, progress) {
+    const scratch = await mkdtemp(join(tmpdir(), 'grayspar-'));
+    const removeScratchAndExit = () => {
+        rmSync(scratch, { recursive: true, force: true });
+        process.exit(CTRL_C_EXIT_CODE);
+    };
+    process.once('SIGINT', removeScratchAndExit);
+    try {
+        const archive = await archiveOf(source.root, source.under, scratch, await uploadLimitsOf(api, destination));
+        const gitState = await gitStateOf(join(source.root, source.under));
+        const body = {
+            bytes: archive.bytes,
+            sha256: archive.sha256,
+            ...(gitState === null ? {} : { gitMetadata: gitState }),
+        };
+        const created = await dataOrThrow(destination.kind === 'project'
+            ? api.POST('/api/projects/{projectId}/uploads', {
+                params: { path: { projectId: destination.project.id } },
+                body,
+            })
+            : api.POST('/api/teams/{teamId}/uploads', {
+                params: { path: { teamId: destination.team.id } },
+                body,
+            }));
+        progress.update('Uploading…');
+        const stored = await fetch(created.url, {
+            method: 'PUT',
+            body: await openAsBlob(archive.path),
+            headers: created.headers,
+            signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+        }).catch(() => null);
+        if (stored?.ok !== true) {
+            throw new CliError('upload_failed', "Your project didn't finish uploading. Deploy again.");
+        }
+        progress.update('Inspecting your project…');
+        await dataOrThrow(destination.kind === 'project'
+            ? api.POST('/api/projects/{projectId}/uploads/{uploadId}/discover', {
+                params: { path: { projectId: destination.project.id, uploadId: created.upload } },
+            })
+            : api.POST('/api/teams/{teamId}/uploads/{uploadId}/discover', {
+                params: { path: { teamId: destination.team.id, uploadId: created.upload } },
+            }));
+        return await awaitDiscovery(api, destination, created.upload);
+    }
+    finally {
+        process.off('SIGINT', removeScratchAndExit);
+        await rm(scratch, { recursive: true, force: true });
+    }
+}
+function printFoundServices(uploaded, variables, isWholeProject) {
+    const count = uploaded.services.length;
+    const rows = uploaded.services.map((service) => [service.name, service.builtWith ?? '…']);
+    const found = count === 0
+        ? []
+        : [
+            `${color.heading(`Found ${String(count)} ${count === 1 ? 'service' : 'services'}`)}\n\n` +
+                table(['SERVICE', 'BUILT WITH'], rows),
+        ];
+    const leftOut = new Set([...variables.values()].flatMap((service) => Object.entries(service.skippedPlatformVariables).map(([key, file]) => `${key} in ${file} is left out, because Grayspar sets it`)));
+    const warnings = [
+        ...leftOut,
+        ...(isWholeProject
+            ? uploaded.leftRunning.map((name) => `${name} is no longer in this folder, and keeps running`)
+            : []),
+    ];
+    const blocks = [...found, ...(warnings.length > 0 ? [warnings.map(warning).join('\n')] : [])];
+    if (blocks.length > 0)
+        process.stdout.write(`${blocks.join('\n\n')}\n\n`);
+}
+async function watchDeployment(api, project, deploymentId, format) {
+    const follow = await commandFor(project, 'grayspar status');
+    const stopWatching = () => {
+        process.stderr.write(`\nThe deploy goes on without this terminal. To follow it, run\n${follow}\n`);
+        process.exit(CTRL_C_EXIT_CODE);
+    };
+    process.once('SIGINT', stopWatching);
+    try {
+        return await awaitDeployment(api, project, deploymentId, { format, label: 'Deploying…' });
+    }
+    finally {
+        process.off('SIGINT', stopWatching);
+    }
+}
+async function printOutcome(api, project, outcome) {
+    if (outcome.status === 'live') {
+        const live = await dataOrThrow(api.GET('/api/projects/{projectId}', { params: { path: { projectId: project.id } } }));
+        process.stdout.write(`${receipt(`Deployed ${live.name}`)}\n\n${servicesTable(live)}\n`);
+        return;
+    }
+    if (outcome.status === 'cancelled') {
+        await printReplacedDeploy(project);
+        return;
+    }
+    await printDeployFailure(api, project, outcome);
+}
+export const deployCommand = new Command('deploy')
+    .argument('[folder]', 'deploy only the files under this folder of the project', '.')
+    .description('build a project folder and put it online')
+    .option('-y, --yes', 'take the plan as shown without asking')
+    .option('--name <name>', 'create a new project with this name')
+    .option('--no-env', 'deploy without reading any .env file')
+    .option('--env-file <path>', 'read variables from a specific file')
+    .addOption(new Option('--env-conflict <winner>', 'which value wins where your .env differs from a saved one').choices(['saved', 'file']))
+    .option('-s, --service <name>', 'deploy only this service, repeatable', collectRepeatedValue)
+    .option('--path <name=path>', 'where a new service answers, repeatable', collectRepeatedValue)
+    .option('--no-path <name>', 'a new service that takes no requests, like a background worker', (name, paths) => collectRepeatedValue(`${name}=${NO_PATH_VALUE}`, paths))
+    .option('--dockerfile <name=path>', 'the Dockerfile a new service builds from', collectRepeatedValue)
+    .option('--volume <name=path>', 'a folder a service keeps across deploys, repeatable', collectRepeatedValue)
+    .action(commandAction((format, command, folder) => {
+    const options = command.opts();
+    return deploy(folder, {
+        format,
+        yes: options.yes === true,
+        name: options.name,
+        env: options.env,
+        envFile: options.envFile,
+        envConflict: options.envConflict,
+        flags: {
+            services: options.service ?? [],
+            paths: options.path ?? [],
+            dockerfiles: options.dockerfile ?? [],
+            volumes: options.volume ?? [],
+        },
+    });
+}));

package/dist/commands/deploy/env-files.js

@@ -0,0 +1,47 @@
+/* A variable found beside the service beats one at the repository root, and a variable Grayspar sets itself is left
+   out wherever it is found. */
+import { readFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { parseEnv } from 'node:util';
+import { CliError } from '../../lib/errors.js';
+const ENV_FILES_IN_ORDER = ['.env', '.env.production', '.env.local'];
+export function emptyFoundVariables() {
+    return { values: {}, sourceFiles: {}, skippedPlatformVariables: {} };
+}
+async function readIfPresent(folder, file) {
+    return readFile(resolve(folder, file), 'utf8').catch(() => null);
+}
+export async function variablesFor(root, serviceFolder, platformVariableNames, envFile) {
+    const values = {};
+    const sourceFiles = {};
+    const skippedPlatformVariables = {};
+    function takeVariables(raw, origin) {
+        for (const [name, value] of Object.entries(parseEnv(raw))) {
+            if (value === undefined)
+                continue;
+            if (platformVariableNames.includes(name)) {
+                skippedPlatformVariables[name] = origin;
+                continue;
+            }
+            values[name] = value;
+            sourceFiles[name] = origin;
+        }
+    }
+    const places = serviceFolder === '.' ? ['.'] : ['.', serviceFolder];
+    for (const place of places) {
+        for (const file of ENV_FILES_IN_ORDER) {
+            const raw = await readIfPresent(join(root, place), file);
+            if (raw === null)
+                continue;
+            takeVariables(raw, place === '.' ? file : `${place}/${file}`);
+        }
+    }
+    if (envFile !== undefined) {
+        const raw = await readIfPresent(process.cwd(), envFile);
+        if (raw === null) {
+            throw new CliError('no_env_file', `No environment file at ${envFile}.\nGive the path of an existing file with --env-file.`, '--env-file');
+        }
+        takeVariables(raw, envFile);
+    }
+    return { values, sourceFiles, skippedPlatformVariables };
+}

package/dist/commands/deploy/git-state.js

@@ -0,0 +1,35 @@
+/* A deploy uploads the files on disk and names the commit only to describe them, so a tree with
+   uncommitted or untracked files says it holds changes beyond that commit. Only the deployed folder counts. */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const execFileAsync = promisify(execFile);
+const GIT_TIMEOUT_MS = 5000;
+const NO_COMMIT_YET = '(initial)';
+const DETACHED = '(detached)';
+async function runGit(folder, args) {
+    const { stdout } = await execFileAsync('git', args, { cwd: folder, timeout: GIT_TIMEOUT_MS });
+    return stdout.trim();
+}
+export async function gitStateOf(folder) {
+    try {
+        const [status, message] = await Promise.all([
+            runGit(folder, ['status', '--porcelain=v2', '--branch', '--', '.']),
+            runGit(folder, ['log', '-1', '--format=%s']),
+        ]);
+        const lines = status.split('\n');
+        const header = (name) => lines.find((line) => line.startsWith(`# ${name} `))?.slice(`# ${name} `.length);
+        const commit = header('branch.oid');
+        const branch = header('branch.head');
+        if (commit === undefined || commit === NO_COMMIT_YET)
+            return null;
+        return {
+            branch: branch === undefined || branch === DETACHED ? null : branch,
+            commit,
+            message,
+            dirty: lines.some((line) => line !== '' && !line.startsWith('#')),
+        };
+    }
+    catch {
+        return null;
+    }
+}

package/dist/commands/deploy/project-name.js

@@ -0,0 +1,13 @@
+/* A project's name is its address too, so it holds only what an address can carry. The API decides; this only turns a
+   folder name or a typed answer into the nearest name it would accept, to offer as the answer. */
+const NAME_LIMIT = 58;
+export function projectNameFrom(text) {
+    const name = text
+        .toLowerCase()
+        .normalize('NFKD')
+        .replace(/\p{M}+/gu, '')
+        .replace(/[^a-z0-9]+/g, '-')
+        .slice(0, NAME_LIMIT)
+        .replace(/^-+|-+$/g, '');
+    return name === '' ? null : name;
+}

package/dist/commands/deploy/submit-deploy.js

@@ -0,0 +1,127 @@
+import { dataOrThrow } from '../../lib/client.js';
+import { CliError } from '../../lib/errors.js';
+import { askChoice, askText, askYesNo, isInteractive } from '../../lib/prompt.js';
+import { failure } from '../../lib/ui.js';
+import { servicesToSend } from './deploy-flags.js';
+const PATH_POINTER_PATTERN = /^#\/services\/(\d+)\/pathPrefix$/;
+function askedIn(refusal, sent) {
+    if (refusal === undefined)
+        return null;
+    if (refusal.questions !== undefined)
+        return { asked: refusal.questions, detail: refusal.detail };
+    const paths = (refusal.errors ?? []).flatMap(({ detail, pointer }) => {
+        const index = PATH_POINTER_PATTERN.exec(pointer ?? '')?.[1];
+        const service = index === undefined ? undefined : sent[Number(index)]?.name;
+        return service === undefined ? [] : [{ service, suggestion: null, problem: detail }];
+    });
+    return paths.length === 0
+        ? null
+        : { asked: { address: [], paths, dockerfiles: [] }, detail: refusal.detail };
+}
+async function sendDeploy(api, destination, body) {
+    if (destination.kind === 'project') {
+        const answer = await api.POST('/api/projects/{projectId}/deployments', {
+            params: { path: { projectId: destination.project.id } },
+            body,
+        });
+        const asked = askedIn(answer.error, body.services ?? []);
+        if (asked !== null)
+            return asked;
+        const { deployment } = await dataOrThrow(Promise.resolve(answer));
+        return { accepted: { project: destination.project, deployment } };
+    }
+    const answer = await api.POST('/api/teams/{teamId}/projects', {
+        params: { path: { teamId: destination.team.id } },
+        body: { ...body, name: destination.name },
+    });
+    const asked = askedIn(answer.error, body.services ?? []);
+    if (asked !== null)
+        return asked;
+    return { accepted: await dataOrThrow(Promise.resolve(answer)) };
+}
+function dockerfileRefusal({ detail }, { dockerfile, service }) {
+    return new CliError('needs_an_answer', `${detail}\nAdd --dockerfile ${service}=${dockerfile} to build it, or --yes to leave it out.`, '--dockerfile');
+}
+function refusalFor({ asked, detail }, suggestionsTaken) {
+    const action = asked.address.length > 0
+        ? 'Choose it with --path <name>=/.'
+        : suggestionsTaken
+            ? 'Give the path with --path <name>=<path>, or --no-path <name> if it takes no requests.'
+            : 'Give each path with --path <name>=<path>, or --no-path <name> if it takes no requests, or take the suggested paths with --yes.';
+    return new CliError('needs_a_path', `${detail}\n${action}`, '--path');
+}
+function suggestionsFor(askedQuestions) {
+    const taken = new Map();
+    for (const { service, suggestion, problem } of askedQuestions.asked.paths) {
+        if (suggestion === null || problem !== null)
+            throw refusalFor(askedQuestions, true);
+        taken.set(service, suggestion);
+    }
+    if (askedQuestions.asked.address.length > 0)
+        throw refusalFor(askedQuestions, true);
+    return taken;
+}
+async function askFirstQuestion(asked, address) {
+    if (asked.address.length > 0) {
+        const root = await askChoice(`Select the service that opens at ${address}`, `Opens at ${address}`, asked.address.map((name) => ({ value: name, label: name })), '--path');
+        return [root, '/'];
+    }
+    const [question] = asked.paths;
+    if (question === undefined)
+        throw new Error('API asked a question without naming one');
+    if (question.problem !== null)
+        process.stdout.write(`${failure(question.problem)}\n`);
+    return [
+        question.service,
+        await askText(`Path for ${question.service}`, question.suggestion, '--path'),
+    ];
+}
+export async function submitDeploy(api, destination, options, serviceFlags, foundNames, request) {
+    const canAsk = isInteractive() && !options.yes;
+    const declinedDockerfiles = [];
+    let hasAsked = false;
+    for (;;) {
+        const sent = await sendDeploy(api, destination, {
+            ...request,
+            services: servicesToSend(foundNames, serviceFlags),
+            ...(declinedDockerfiles.length === 0 ? {} : { declinedDockerfiles }),
+        });
+        if ('accepted' in sent) {
+            if (hasAsked)
+                process.stdout.write('\n');
+            return sent.accepted;
+        }
+        const [dockerfile] = sent.asked.dockerfiles;
+        if (dockerfile !== undefined) {
+            if (options.yes) {
+                declinedDockerfiles.push(...sent.asked.dockerfiles.map((question) => question.dockerfile));
+                continue;
+            }
+            if (!canAsk)
+                throw dockerfileRefusal(sent, dockerfile);
+            const builds = await askYesNo(`Build ${dockerfile.dockerfile} from the project's root as the service ${dockerfile.service}?`, false, '--dockerfile');
+            hasAsked = true;
+            if (!builds) {
+                declinedDockerfiles.push(dockerfile.dockerfile);
+                continue;
+            }
+            serviceFlags.dockerfiles.set(dockerfile.service, dockerfile.dockerfile);
+            if (serviceFlags.onlyServices.length > 0)
+                serviceFlags.onlyServices.push(dockerfile.service);
+            continue;
+        }
+        if (!options.yes && !canAsk)
+            throw refusalFor(sent, false);
+        const given = options.yes
+            ? suggestionsFor(sent)
+            : new Map([await askFirstQuestion(sent.asked, addressOf(destination))]);
+        hasAsked ||= !options.yes;
+        for (const [name, path] of given)
+            serviceFlags.paths.set(name, path);
+    }
+}
+function addressOf(destination) {
+    return destination.kind === 'project'
+        ? new URL(destination.project.url).host
+        : "the project's address";
+}

package/dist/commands/deploy/variables-to-send.js

@@ -0,0 +1,140 @@
+/* The saved variables are the source of truth: a deploy adds what the project lacks once its names have been shown,
+   asks before a local value replaces a saved one, and keeps a value that points at this machine on it. */
+import { createHmac } from 'node:crypto';
+import { stat } from 'node:fs/promises';
+import { join } from 'node:path';
+import { dataOrThrow } from '../../lib/client.js';
+import { CliError } from '../../lib/errors.js';
+import { askChoice, askYesNo, isInteractive } from '../../lib/prompt.js';
+import { color, table, warning } from '../../lib/ui.js';
+const LOCAL_HOST_PATTERN = /(?:^|[^\w.-])(?:localhost|127\.0\.0\.1)(?![\w.-])/;
+export function pointsAtThisMachine(value) {
+    return LOCAL_HOST_PATTERN.test(value);
+}
+export function comparisonOf(saved, local) {
+    return Object.fromEntries(Object.entries(local).map(([service, values]) => [
+        service,
+        Object.fromEntries(Object.entries(values).map(([key, value]) => {
+            const entry = saved[service]?.find((variable) => variable.name === key);
+            if (entry === undefined)
+                return [key, { state: 'new', savedAt: null }];
+            const hash = createHmac('sha256', Buffer.from(entry.salt, 'base64url'))
+                .update(value)
+                .digest('hex');
+            return [
+                key,
+                { state: hash === entry.hash ? 'same' : 'different', savedAt: entry.updatedAt },
+            ];
+        })),
+    ]));
+}
+export function newVariablesOf(services, variables, comparison) {
+    return services.flatMap((service, index) => {
+        const found = variables[index];
+        if (found === undefined)
+            return [];
+        return Object.entries(found.values)
+            .filter(([key]) => (comparison[service]?.[key]?.state ?? 'new') === 'new')
+            .map(([key, value]) => ({
+            service,
+            key,
+            file: found.sourceFiles[key] ?? '.env',
+            leftOut: pointsAtThisMachine(value),
+        }));
+    });
+}
+export function sendableVariables(services, variables, comparison, fileWins) {
+    return Object.fromEntries(services.map((service, index) => {
+        const values = variables[index]?.values ?? {};
+        const kept = Object.entries(values).filter(([key]) => {
+            const state = comparison[service]?.[key]?.state ?? 'new';
+            if (state === 'new')
+                return true;
+            if (state === 'same')
+                return false;
+            return fileWins({ service, key });
+        });
+        return [service, Object.fromEntries(kept)];
+    }));
+}
+function timeAgo(at) {
+    const minutes = Math.max(0, Math.floor((Date.now() - at.getTime()) / 60_000));
+    if (minutes < 1)
+        return 'just now';
+    if (minutes < 60)
+        return `${minutes}m ago`;
+    if (minutes < 60 * 24)
+        return `${Math.floor(minutes / 60)}h ago`;
+    return `${Math.floor(minutes / (60 * 24))}d ago`;
+}
+async function editedAt(root, file) {
+    if (file === undefined)
+        return null;
+    return stat(join(root, file)).then((found) => found.mtime, () => null);
+}
+function leftOutWarning({ service, key, file }) {
+    return warning(`${key} in ${file} points at localhost, so it was left out. Set it with grayspar env set ${key}=… --service ${service}`);
+}
+async function confirmNewVariables(sendable, fresh, { projectName, format, yes }) {
+    const leftOut = fresh.filter((variable) => variable.leftOut);
+    const offered = fresh.filter((variable) => !variable.leftOut);
+    const dropped = (names) => {
+        for (const { service, key } of names)
+            delete sendable[service]?.[key];
+    };
+    dropped(leftOut);
+    const warnings = leftOut.map(leftOutWarning);
+    if (offered.length > 0 && !yes) {
+        const one = offered.length === 1;
+        const many = one ? 'variable' : 'variables';
+        if (format !== 'text' || !isInteractive()) {
+            const them = one ? 'it' : 'them';
+            throw new CliError('needs_an_answer', `${offered.length} ${many} in .env files ${one ? 'is' : 'are'} new to ${projectName}, and there is no terminal to ask whether to send ${them}.\nSend ${them} with --yes, or deploy without .env files with --no-env.`, '--yes');
+        }
+        process.stdout.write(`${color.heading(`Found ${offered.length} new ${many}`)}\n\n` +
+            `${table(['SERVICE', 'VARIABLE', 'FILE'], offered.map(({ service, key, file }) => [service, key, file]))}\n` +
+            (warnings.length === 0 ? '' : `\n${warnings.join('\n')}\n`) +
+            '\n');
+        const send = await askYesNo(`Send ${offered.length} ${many} to ${projectName}?`, true, '--yes');
+        process.stdout.write('\n');
+        if (!send)
+            dropped(offered);
+    }
+    else if (warnings.length > 0 && format === 'text') {
+        process.stdout.write(`${warnings.join('\n')}\n\n`);
+    }
+    return { variables: sendable, leftOut };
+}
+export async function variablesToSend(api, project, root, services, variables, envConflict, asking) {
+    const local = Object.fromEntries(services.map((service, index) => [service, variables[index]?.values ?? {}]));
+    const saved = project === null
+        ? {}
+        : await dataOrThrow(api.GET('/api/projects/{projectId}/env', { params: { path: { projectId: project.id } } }));
+    const comparison = comparisonOf(saved, local);
+    const fresh = newVariablesOf(services, variables, comparison);
+    const conflicts = services.flatMap((service) => Object.entries(comparison[service] ?? {})
+        .filter(([, entry]) => entry.state === 'different')
+        .map(([key]) => ({ service, key })));
+    if (conflicts.length === 0 || envConflict !== undefined) {
+        return confirmNewVariables(sendableVariables(services, variables, comparison, () => envConflict === 'file'), fresh, asking);
+    }
+    const names = conflicts.map(({ service, key }) => `${key} on ${service}`).join(', ');
+    if (!isInteractive()) {
+        throw new CliError('env_differs', `${names} ${conflicts.length === 1 ? 'differs from its saved value' : 'differ from their saved values'}. Pass --env-conflict saved or --env-conflict file.`, '--env-conflict');
+    }
+    const fileWinsByConflict = new Map();
+    for (const { service, key } of conflicts) {
+        const saved = comparison[service]?.[key]?.savedAt;
+        const index = services.indexOf(service);
+        const file = variables[index]?.sourceFiles[key];
+        const edited = await editedAt(root, file);
+        const savedAndEditedNote = `Saved ${saved ? timeAgo(new Date(saved)) : 'earlier'}${edited === null ? '' : `, ${file ?? '.env'} edited ${timeAgo(edited)}`}`;
+        process.stdout.write(`\n${color.heading(key)} on ${service} differs from the saved value.\n${savedAndEditedNote}.\n`);
+        const pick = await askChoice(`Select the value of ${key} for ${service}`, `${key} for ${service}`, [
+            { value: 'saved', label: 'Keep the saved value' },
+            { value: 'file', label: `Use the one in ${file ?? '.env'}` },
+        ], '--env-conflict');
+        fileWinsByConflict.set(`${service} ${key}`, pick === 'file');
+    }
+    return confirmNewVariables(sendableVariables(services, variables, comparison, ({ service, key }) => fileWinsByConflict.get(`${service} ${key}`) === true), fresh, asking);
+}