@kaupang/core 0.1.0

package/dist/internal.js

@@ -0,0 +1,1535 @@
+// src/config/loader.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, readdirSync } from "node:fs";
+import { basename, dirname, extname, join as join2, resolve as resolve2 } from "node:path";
+import { createJiti } from "jiti";
+
+// src/catalog/source.ts
+import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { execa } from "execa";
+
+// src/util/registry.ts
+function registryHost(ref) {
+  return ref.replace(/^oci:\/\//, "").split("/")[0] ?? "";
+}
+function isLoopback(host) {
+  return /^(localhost|127\.0\.0\.1|\[::1\])(:\d+)?$/.test(host);
+}
+function orasRegistryArgs(ref) {
+  if (isLoopback(registryHost(ref)) || process.env.KAUPANG_ORAS_PLAIN_HTTP) {
+    return ["--plain-http"];
+  }
+  return [];
+}
+
+// src/catalog/source.ts
+var FileCatalogSource = class {
+  constructor(path) {
+    this.path = path;
+    this.describe = `file:${path}`;
+  }
+  describe;
+  async load() {
+    if (!existsSync(this.path)) {
+      throw new Error(`Catalog file not found: ${this.path}`);
+    }
+    return JSON.parse(readFileSync(this.path, "utf8"));
+  }
+};
+var HttpCatalogSource = class {
+  constructor(url, headers, kind = "http") {
+    this.url = url;
+    this.headers = headers;
+    this.describe = `${kind}:${url}`;
+  }
+  describe;
+  async load() {
+    const res = await fetch(this.url, { headers: this.headers });
+    if (!res.ok) {
+      throw new Error(`Catalog ${res.status} from ${this.url}`);
+    }
+    return await res.json();
+  }
+};
+var OciCatalogSource = class {
+  constructor(ref, file = "catalog.json") {
+    this.ref = ref;
+    this.file = file;
+    this.describe = `oci:${ref}`;
+  }
+  describe;
+  async load() {
+    const dir = mkdtempSync(join(tmpdir(), "kaupang-oci-"));
+    try {
+      await execa("oras", ["pull", ...orasRegistryArgs(this.ref), this.ref, "-o", dir]);
+    } catch (err) {
+      const e = err;
+      if (e.code === "ENOENT") {
+        throw new Error(
+          `Catalog "oci" source needs the \`oras\` CLI on PATH (https://oras.land). Install it, or use a file / http / service source instead.`
+        );
+      }
+      throw new Error(`oras pull ${this.ref} failed: ${e.message ?? String(err)}`);
+    }
+    const file = join(dir, this.file);
+    try {
+      if (!existsSync(file)) {
+        throw new Error(
+          `Pulled ${this.ref} but it has no "${this.file}". Push it as that filename: oras push ${this.ref} ${this.file}`
+        );
+      }
+      return JSON.parse(readFileSync(file, "utf8"));
+    } finally {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  }
+};
+function createSource(cfg, rootDir) {
+  switch (cfg.type) {
+    case "file":
+      if (!cfg.path) throw new Error('Catalog "file" source needs a `path`.');
+      return new FileCatalogSource(resolve(rootDir, cfg.path));
+    case "http":
+      if (!cfg.url) throw new Error('Catalog "http" source needs a `url`.');
+      return new HttpCatalogSource(cfg.url, cfg.headers, "http");
+    case "service":
+      if (!cfg.url) throw new Error('Catalog "service" source needs a `url`.');
+      return new HttpCatalogSource(cfg.url, cfg.headers, "service");
+    case "oci":
+      if (!cfg.ref) throw new Error('Catalog "oci" source needs a `ref`.');
+      return new OciCatalogSource(cfg.ref, cfg.path);
+    default:
+      throw new Error(`Unknown catalog source type "${cfg.type}".`);
+  }
+}
+function createCatalogResolver(config, rootDir) {
+  const sources = (config?.sources ?? []).map((c2) => createSource(c2, rootDir));
+  let merged = null;
+  const loadAll = () => {
+    if (!merged) {
+      merged = (async () => {
+        const out = { services: {}, solutions: {} };
+        for (const source of [...sources].reverse()) {
+          const manifest = await source.load();
+          Object.assign(out.services, manifest.services ?? {});
+          Object.assign(out.solutions, manifest.solutions ?? {});
+        }
+        return out;
+      })();
+    }
+    return merged;
+  };
+  const requireSources = (what, name) => {
+    if (sources.length === 0) {
+      throw new Error(
+        `${what} "${name}" was requested but no catalog sources are configured. Add a \`catalog: { sources: [...] }\` to kaupang.config.ts.`
+      );
+    }
+  };
+  return {
+    async resolve(name) {
+      requireSources("Catalog preset", name);
+      const { services } = await loadAll();
+      const spec = services[name];
+      if (!spec) {
+        const available = Object.keys(services).sort().join(", ") || "(none)";
+        throw new Error(`Catalog preset "${name}" not found. Available: ${available}.`);
+      }
+      return structuredClone(spec);
+    },
+    async list() {
+      return Object.keys((await loadAll()).services).sort();
+    },
+    async resolveSolution(name) {
+      requireSources("Solution", name);
+      const { solutions } = await loadAll();
+      const recipe = solutions[name];
+      if (!recipe) {
+        const available = Object.keys(solutions).sort().join(", ") || "(none)";
+        throw new Error(`Solution "${name}" not found in catalog. Available: ${available}.`);
+      }
+      return structuredClone(recipe);
+    },
+    async listSolutions() {
+      return Object.keys((await loadAll()).solutions).sort();
+    }
+  };
+}
+
+// src/config/normalize.ts
+function toArray(value) {
+  if (!value) return [];
+  return Array.isArray(value) ? value : [value];
+}
+function resolveImage(image, repo) {
+  if (!image || !repo) return image;
+  if (image.includes("/")) return image;
+  return `${repo.replace(/\/+$/, "")}/${image}`;
+}
+function isCatalogRef(input) {
+  return typeof input === "object" && input !== null && "$catalog" in input;
+}
+function mergeSpec(base, overrides) {
+  if (!overrides) return base;
+  return {
+    ...base,
+    ...overrides,
+    env: { ...base.env, ...overrides.env },
+    labels: { ...base.labels, ...overrides.labels }
+  };
+}
+function finalize(spec, ctx, fromCatalog) {
+  const { dependsOn, image, pull, ...rest } = spec;
+  return {
+    ...rest,
+    // Catalog presets carry their own (public) images — don't re-prefix them.
+    image: fromCatalog ? image : resolveImage(image, ctx.dockerRepository),
+    dependsOn: toArray(dependsOn),
+    pull: pull ?? ctx.defaultPull
+  };
+}
+async function normalizeService(input, ctx) {
+  if (typeof input === "string") {
+    return finalize({ image: input }, ctx, false);
+  }
+  if (isCatalogRef(input)) {
+    const base = await ctx.catalog.resolve(input.$catalog);
+    return finalize(mergeSpec(base, input.overrides), ctx, true);
+  }
+  return finalize(input, ctx, false);
+}
+async function normalizeEnvironment(def, name, file, ctx) {
+  const localCtx = {
+    catalog: ctx.catalog,
+    dockerRepository: def.dockerRepository ?? ctx.dockerRepository,
+    defaultPull: def.pull ?? ctx.defaultPull
+  };
+  const services = {};
+  for (const [key2, input] of Object.entries(def.services)) {
+    services[key2] = await normalizeService(input, localCtx);
+  }
+  return {
+    name,
+    file,
+    services,
+    dependsOn: toArray(def.dependsOn),
+    env: def.env ?? {},
+    hooks: def.hooks,
+    networks: def.networks,
+    volumes: def.volumes
+  };
+}
+
+// src/config/loader.ts
+var CONFIG_NAMES = [
+  "kaupang.config.ts",
+  "kaupang.config.mjs",
+  "kaupang.config.js",
+  "kaupang.config.json"
+];
+var ENV_INDEX_NAMES = ["index.ts", "index.mjs", "index.js", "index.json"];
+var ENV_FILE_RE = /\.(ts|mts|mjs|js|json)$/;
+function findConfig(cwd = process.cwd()) {
+  let dir = resolve2(cwd);
+  while (true) {
+    for (const name of CONFIG_NAMES) {
+      const candidate = join2(dir, name);
+      if (existsSync2(candidate)) return candidate;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+function sanitizeProject(name) {
+  return name.toLowerCase().replace(/[^a-z0-9_-]+/g, "_").replace(/^[_-]+|[_-]+$/g, "") || "kaupang";
+}
+async function loadConfig(cwd = process.cwd()) {
+  const configPath = findConfig(cwd);
+  if (!configPath) {
+    throw new Error(
+      `No kaupang config found. Create a "kaupang.config.ts" (or .mjs / .js / .json) in ${resolve2(cwd)} or a parent directory.`
+    );
+  }
+  const rootDir = dirname(configPath);
+  const jiti = createJiti(rootDir, { moduleCache: false });
+  const config = await importDefault(jiti, configPath);
+  if (!config || typeof config.environments !== "string") {
+    throw new Error(
+      `${configPath} must \`export default defineConfig({ environments: "<folder>" })\`.`
+    );
+  }
+  const envDir = resolve2(rootDir, config.environments);
+  if (!existsSync2(envDir)) {
+    throw new Error(
+      `Environments folder not found: ${envDir} (config.environments = "${config.environments}").`
+    );
+  }
+  const cacheDir = resolve2(rootDir, config.cacheDir ?? ".kaupang");
+  const project = sanitizeProject(config.project ?? basename(rootDir));
+  const catalog = createCatalogResolver(config.catalog, rootDir);
+  const environments = await loadEnvironments(jiti, envDir, config, catalog);
+  return { config, configPath, rootDir, cacheDir, project, catalog, environments };
+}
+async function loadEnvironments(jiti, envDir, config, catalog) {
+  const map = /* @__PURE__ */ new Map();
+  for (const entry of readdirSync(envDir, { withFileTypes: true })) {
+    let file = null;
+    let fallbackName = entry.name;
+    if (entry.isFile() && ENV_FILE_RE.test(entry.name) && !entry.name.endsWith(".d.ts")) {
+      file = join2(envDir, entry.name);
+      fallbackName = basename(entry.name, extname(entry.name));
+    } else if (entry.isDirectory()) {
+      for (const idx of ENV_INDEX_NAMES) {
+        const candidate = join2(envDir, entry.name, idx);
+        if (existsSync2(candidate)) {
+          file = candidate;
+          break;
+        }
+      }
+    }
+    if (!file) continue;
+    const def = await importDefault(jiti, file);
+    if (!def || typeof def.services !== "object") {
+      throw new Error(
+        `${file} must \`export default defineEnvironment({ services: { ... } })\`.`
+      );
+    }
+    const name = def.name ?? fallbackName;
+    if (map.has(name)) {
+      throw new Error(
+        `Duplicate environment name "${name}" (in ${file} and ${map.get(name).file}).`
+      );
+    }
+    const normalized = await normalizeEnvironment(def, name, file, {
+      dockerRepository: config.dockerRepository,
+      defaultPull: config.defaultPull,
+      catalog
+    });
+    map.set(name, normalized);
+  }
+  return map;
+}
+async function importDefault(jiti, path) {
+  if (path.endsWith(".json")) {
+    try {
+      return JSON.parse(readFileSync2(path, "utf8"));
+    } catch (err) {
+      throw new Error(`Failed to parse ${path}: ${err.message}`);
+    }
+  }
+  const mod = await jiti.import(path);
+  return mod.default ?? mod;
+}
+
+// src/context.ts
+function makeContext(loaded, opts = {}) {
+  return {
+    rootDir: loaded.rootDir,
+    cacheDir: loaded.cacheDir,
+    project: loaded.project,
+    baseEnv: loaded.config.globalEnv ?? {},
+    targetEnv: opts.targetEnv ?? {},
+    pull: opts.pull
+  };
+}
+
+// src/graph/resolver.ts
+function topoSort(nodes, deps, label) {
+  const indegree = /* @__PURE__ */ new Map();
+  const dependents = /* @__PURE__ */ new Map();
+  for (const n of nodes) {
+    indegree.set(n, 0);
+    dependents.set(n, []);
+  }
+  for (const n of nodes) {
+    for (const d of deps.get(n) ?? []) {
+      if (!indegree.has(d)) {
+        throw new Error(`${label} "${n}" depends on unknown "${d}".`);
+      }
+      indegree.set(n, indegree.get(n) + 1);
+      dependents.get(d).push(n);
+    }
+  }
+  const order = [];
+  const waves = [];
+  let frontier = nodes.filter((n) => indegree.get(n) === 0).sort();
+  while (frontier.length > 0) {
+    waves.push([...frontier]);
+    const next = [];
+    for (const n of frontier) {
+      order.push(n);
+      for (const dep of dependents.get(n)) {
+        indegree.set(dep, indegree.get(dep) - 1);
+        if (indegree.get(dep) === 0) next.push(dep);
+      }
+    }
+    frontier = next.sort();
+  }
+  if (order.length !== nodes.length) {
+    const cyclic = nodes.filter((n) => !order.includes(n));
+    throw new Error(
+      `Dependency cycle detected among ${label}s: ${cyclic.join(", ")}.`
+    );
+  }
+  return { order, waves };
+}
+function resolvePlan(target, environments, backend) {
+  if (!environments.has(target)) {
+    const available = [...environments.keys()].sort().join(", ") || "(none)";
+    throw new Error(`Unknown environment "${target}". Available: ${available}.`);
+  }
+  return buildPlan([target], target, environments, backend);
+}
+function resolveMultiPlan(roots, label, environments, backend) {
+  return buildPlan(roots, label, environments, backend);
+}
+function buildPlan(roots, label, environments, backend) {
+  const involved = /* @__PURE__ */ new Set();
+  const visit = (name, stack) => {
+    if (stack.includes(name)) {
+      throw new Error(
+        `Environment dependency cycle: ${[...stack, name].join(" -> ")}.`
+      );
+    }
+    if (involved.has(name)) return;
+    const env = environments.get(name);
+    if (!env) {
+      const from = stack.at(-1) ?? "(root)";
+      throw new Error(
+        `Environment "${name}" (required by "${from}") was not found.`
+      );
+    }
+    involved.add(name);
+    for (const dep of env.dependsOn ?? []) visit(dep, [...stack, name]);
+  };
+  for (const root of roots) visit(root, []);
+  const envDeps = /* @__PURE__ */ new Map();
+  for (const name of involved) {
+    const env = environments.get(name);
+    envDeps.set(name, (env.dependsOn ?? []).filter((d) => involved.has(d)));
+  }
+  const { order: envOrder } = topoSort([...involved], envDeps, "environment");
+  const plans = envOrder.map((name) => {
+    const env = environments.get(name);
+    const serviceNames = Object.keys(env.services);
+    const svcDeps = /* @__PURE__ */ new Map();
+    for (const svc of serviceNames) {
+      const declared = env.services[svc].dependsOn ?? [];
+      for (const d of declared) {
+        if (!env.services[d]) {
+          throw new Error(
+            `Service "${svc}" in environment "${name}" depends on unknown service "${d}".`
+          );
+        }
+      }
+      svcDeps.set(svc, declared);
+    }
+    const { order, waves } = topoSort(serviceNames, svcDeps, "service");
+    return {
+      name,
+      file: env.file,
+      env: env.env ?? {},
+      dependsOn: env.dependsOn ?? [],
+      order,
+      waves,
+      services: env.services,
+      hooks: env.hooks
+    };
+  });
+  return { target: label, backend, environments: plans };
+}
+
+// src/backends/compose.ts
+import { join as join3 } from "node:path";
+
+// src/backends/compose-spec.ts
+import { stringify } from "yaml";
+
+// src/util/env.ts
+function isSecret(value) {
+  return typeof value === "object" && value !== null && "$secret" in value;
+}
+function mergeEnv(...maps) {
+  const out = {};
+  for (const m of maps) if (m) Object.assign(out, m);
+  return out;
+}
+function renderComposeEnv(env) {
+  const out = {};
+  for (const [key2, value] of Object.entries(env)) {
+    out[key2] = isSecret(value) ? `\${${value.$secret}}` : value;
+  }
+  return out;
+}
+function requiredSecretVars(...maps) {
+  const set = /* @__PURE__ */ new Set();
+  for (const m of maps) {
+    if (!m) continue;
+    for (const value of Object.values(m)) {
+      if (isSecret(value)) set.add(value.$secret);
+    }
+  }
+  return [...set];
+}
+
+// src/backends/compose-spec.ts
+function renderComposeFile(env, opts) {
+  const completing = new Set(
+    Object.entries(env.services).filter(([, def]) => def.runOnce).map(([name]) => name)
+  );
+  const services = {};
+  for (const [name, def] of Object.entries(env.services)) {
+    services[name] = toComposeService(def, opts, env.env, completing);
+  }
+  const spec = { services };
+  const networks = collectNetworks(env);
+  if (networks.length) {
+    spec.networks = Object.fromEntries(networks.map((n) => [n, {}]));
+  }
+  const volumes = collectVolumes(env);
+  if (volumes.length) {
+    spec.volumes = Object.fromEntries(volumes.map((v) => [v, {}]));
+  }
+  return `# Generated by kaupang \u2014 do not edit by hand.
+${stringify(spec)}`;
+}
+function toComposeService(def, opts, envVars, completing) {
+  const svc = {};
+  if (def.image) svc.image = def.image;
+  if (def.build) svc.build = def.build;
+  if (def.command) svc.command = def.command;
+  if (def.ports?.length) svc.ports = def.ports;
+  if (def.volumes?.length) svc.volumes = def.volumes;
+  if (def.networks?.length) svc.networks = def.networks;
+  if (def.labels) svc.labels = def.labels;
+  if (def.pull && !opts.swarm) svc.pull_policy = def.pull;
+  const merged = mergeEnv(opts.baseEnv, envVars, opts.targetEnv, def.env);
+  const environment = renderComposeEnv(merged);
+  if (Object.keys(environment).length) svc.environment = environment;
+  if (def.healthcheck) {
+    svc.healthcheck = {
+      test: def.healthcheck.test,
+      interval: def.healthcheck.interval,
+      timeout: def.healthcheck.timeout,
+      retries: def.healthcheck.retries,
+      start_period: def.healthcheck.startPeriod
+    };
+  }
+  const restart = def.runOnce ? "no" : def.restart;
+  if (opts.swarm) {
+    const deploy = {};
+    if (def.replicas != null) deploy.replicas = def.replicas;
+    if (restart) deploy.restart_policy = { condition: toSwarmCondition(restart) };
+    if (Object.keys(deploy).length) svc.deploy = deploy;
+  } else {
+    if (def.dependsOn?.length) svc.depends_on = renderDependsOn(def.dependsOn, completing);
+    if (restart) svc.restart = restart;
+    if (def.replicas != null) svc.deploy = { replicas: def.replicas };
+  }
+  return svc;
+}
+function renderDependsOn(deps, completing) {
+  if (!deps.some((d) => completing.has(d))) return deps;
+  return Object.fromEntries(
+    deps.map((d) => [
+      d,
+      { condition: completing.has(d) ? "service_completed_successfully" : "service_started" }
+    ])
+  );
+}
+function toSwarmCondition(restart) {
+  switch (restart) {
+    case "no":
+      return "none";
+    case "on-failure":
+      return "on-failure";
+    default:
+      return "any";
+  }
+}
+function collectNetworks(env) {
+  const set = /* @__PURE__ */ new Set();
+  for (const svc of Object.values(env.services)) {
+    for (const n of svc.networks ?? []) set.add(n);
+  }
+  return [...set];
+}
+function collectVolumes(env) {
+  const set = /* @__PURE__ */ new Set();
+  for (const svc of Object.values(env.services)) {
+    for (const v of svc.volumes ?? []) {
+      const source = v.split(":")[0];
+      if (source && !source.includes("/") && !source.includes(".")) set.add(source);
+    }
+  }
+  return [...set];
+}
+
+// src/util/names.ts
+function sanitize(name) {
+  return name.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^[-_]+|[-_]+$/g, "") || "default";
+}
+function k8sName(name) {
+  return name.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/^[-]+|[-]+$/g, "").slice(0, 63) || "default";
+}
+function stackName(project, env) {
+  return `${sanitize(project)}_${sanitize(env)}`;
+}
+
+// src/backends/compose.ts
+function composeFilePath(env, ctx) {
+  return join3(ctx.cacheDir, stackName(ctx.project, env.name), "docker-compose.yml");
+}
+function resolveImageFlag(pull) {
+  if (pull === "missing") return "changed";
+  return pull;
+}
+var composeBackend = {
+  name: "compose",
+  materialize(env, ctx) {
+    const file = composeFilePath(env, ctx);
+    const project = stackName(ctx.project, env.name);
+    const content = renderComposeFile(env, { swarm: false, baseEnv: ctx.baseEnv, targetEnv: ctx.targetEnv });
+    const base = ["compose", "-p", project, "--project-directory", ctx.rootDir, "-f", file];
+    const upArgs = [...base, "up", "-d", "--wait"];
+    if (ctx.pull) upArgs.push("--pull", ctx.pull);
+    return {
+      files: [{ path: file, content }],
+      up: [{ description: `compose up ${env.name}`, file: "docker", args: upArgs }],
+      down: [
+        {
+          description: `compose down ${env.name}`,
+          file: "docker",
+          args: [...base, "down"]
+        }
+      ],
+      build: [
+        {
+          description: `compose build ${env.name}`,
+          file: "docker",
+          args: [...base, "build"]
+        }
+      ],
+      push: [
+        {
+          description: `compose push ${env.name}`,
+          file: "docker",
+          args: [...base, "push"]
+        }
+      ]
+    };
+  }
+};
+var swarmBackend = {
+  name: "swarm",
+  materialize(env, ctx) {
+    const file = composeFilePath(env, ctx);
+    const stack = stackName(ctx.project, env.name);
+    const content = renderComposeFile(env, { swarm: true, baseEnv: ctx.baseEnv, targetEnv: ctx.targetEnv });
+    const deployArgs = ["stack", "deploy", "--detach=false", "-c", file, stack];
+    if (ctx.pull) deployArgs.splice(2, 0, `--resolve-image=${resolveImageFlag(ctx.pull)}`);
+    return {
+      files: [{ path: file, content }],
+      up: [{ description: `stack deploy ${stack}`, file: "docker", args: deployArgs }],
+      down: [
+        {
+          description: `stack rm ${stack}`,
+          file: "docker",
+          args: ["stack", "rm", stack]
+        }
+      ],
+      // Swarm has no build step; build + push out of band (or via `kaupang build`
+      // on the compose backend, then deploy the pushed image).
+      build: []
+    };
+  }
+};
+
+// src/backends/kubernetes.ts
+import { join as join4 } from "node:path";
+import { stringify as stringify2 } from "yaml";
+var kubernetesBackend = {
+  name: "kubernetes",
+  materialize(env, ctx) {
+    const namespace = k8sName(stackName(ctx.project, env.name));
+    const docs = [
+      {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: { name: namespace, labels: { "app.kubernetes.io/managed-by": "kaupang" } }
+      }
+    ];
+    for (const [name, def] of Object.entries(env.services)) {
+      docs.push(deployment(name, def, namespace, ctx, env.env));
+      if (def.ports?.length) docs.push(service(name, def, namespace));
+    }
+    const file = join4(ctx.cacheDir, namespace, "manifest.yaml");
+    const content = docs.map((d) => stringify2(d)).join("---\n");
+    return {
+      files: [{ path: file, content: `# Generated by kaupang
+${content}` }],
+      up: [
+        {
+          description: `kubectl apply (${namespace})`,
+          file: "kubectl",
+          args: ["apply", "-f", file]
+        }
+      ],
+      down: [
+        {
+          description: `kubectl delete namespace ${namespace}`,
+          file: "kubectl",
+          args: ["delete", "namespace", namespace, "--ignore-not-found"]
+        }
+      ],
+      build: []
+    };
+  }
+};
+function deployment(name, def, namespace, ctx, envVars) {
+  if (!def.image) {
+    throw new Error(
+      `Service "${name}" needs an "image" for the kubernetes backend (build contexts are not supported).`
+    );
+  }
+  const appName = k8sName(name);
+  const env = mergeEnv(ctx.baseEnv, envVars, ctx.targetEnv, def.env);
+  const secretName = `${k8sName(ctx.project)}-secrets`;
+  const container = {
+    name: appName,
+    image: def.image
+  };
+  if (def.command) {
+    container.command = Array.isArray(def.command) ? def.command : ["sh", "-c", def.command];
+  }
+  if (def.ports?.length) {
+    container.ports = def.ports.map((p) => ({ containerPort: containerPort(p) }));
+  }
+  if (Object.keys(env).length) {
+    container.env = Object.entries(env).map(
+      ([k, v]) => isSecret(v) ? { name: k, valueFrom: { secretKeyRef: { name: secretName, key: v.$secret } } } : { name: k, value: v }
+    );
+  }
+  return {
+    apiVersion: "apps/v1",
+    kind: "Deployment",
+    metadata: { name: appName, namespace, labels: { app: appName } },
+    spec: {
+      replicas: def.replicas ?? 1,
+      selector: { matchLabels: { app: appName } },
+      template: {
+        metadata: { labels: { app: appName } },
+        spec: { containers: [container] }
+      }
+    }
+  };
+}
+function service(name, def, namespace) {
+  const appName = k8sName(name);
+  return {
+    apiVersion: "v1",
+    kind: "Service",
+    metadata: { name: appName, namespace },
+    spec: {
+      selector: { app: appName },
+      ports: (def.ports ?? []).map((p) => {
+        const target = containerPort(p);
+        return { port: hostPort(p) ?? target, targetPort: target };
+      })
+    }
+  };
+}
+function containerPort(p) {
+  const parts = p.split(":");
+  return Number(parts.at(-1));
+}
+function hostPort(p) {
+  const parts = p.split(":");
+  return parts.length > 1 ? Number(parts[0]) : void 0;
+}
+
+// src/backends/index.ts
+var backends = {
+  compose: composeBackend,
+  swarm: swarmBackend,
+  kubernetes: kubernetesBackend
+};
+function getBackend(name) {
+  const backend = backends[name];
+  if (!backend) {
+    throw new Error(
+      `Unknown backend "${name}". Use one of: ${Object.keys(backends).join(", ")}.`
+    );
+  }
+  return backend;
+}
+var backendNames = Object.keys(backends);
+
+// src/image/resolve.ts
+import { execa as execa2 } from "execa";
+import { consola } from "consola";
+var FLOATING_TAGS = /* @__PURE__ */ new Set([
+  "latest",
+  "edge",
+  "stable",
+  "main",
+  "master",
+  "dev",
+  "nightly"
+]);
+function isPinned(ref) {
+  return ref.includes("@sha256:");
+}
+function repository(ref) {
+  const base = ref.includes("@") ? ref.slice(0, ref.indexOf("@")) : ref;
+  const slash = base.lastIndexOf("/");
+  const colon = base.lastIndexOf(":");
+  return colon > slash ? base.slice(0, colon) : base;
+}
+function tagOf(ref) {
+  const base = ref.includes("@") ? ref.slice(0, ref.indexOf("@")) : ref;
+  const slash = base.lastIndexOf("/");
+  const colon = base.lastIndexOf(":");
+  return colon > slash ? base.slice(colon + 1) : void 0;
+}
+async function resolveDigest(ref) {
+  if (isPinned(ref)) return ref.slice(ref.indexOf("@") + 1);
+  try {
+    const { stdout } = await execa2("docker", [
+      "buildx",
+      "imagetools",
+      "inspect",
+      ref,
+      "--format",
+      "{{.Manifest.Digest}}"
+    ]);
+    const digest = stdout.trim();
+    if (digest.startsWith("sha256:")) return digest;
+    throw new Error(`unexpected output "${digest}"`);
+  } catch (err) {
+    throw new Error(
+      `Could not resolve a digest for "${ref}". Ensure the image is pushed and you are authenticated, or pass --no-resolve to deploy the reference as-is. (${err.message})`
+    );
+  }
+}
+async function resolveEnvironmentImages(env) {
+  const services = {};
+  const images = [];
+  for (const [key2, def] of Object.entries(env.services)) {
+    if (def.build || !def.image) {
+      services[key2] = def;
+      continue;
+    }
+    const ref = def.image;
+    const digest = await resolveDigest(ref);
+    const pinned = `${repository(ref)}@${digest}`;
+    const tag = tagOf(ref);
+    const floating = !isPinned(ref) && (tag === void 0 || FLOATING_TAGS.has(tag));
+    images.push({ service: key2, ref, digest, pinned, floating });
+    services[key2] = { ...def, image: pinned };
+    consola.log(
+      `  ${ref} \u2192 ${digest.slice(0, 19)}\u2026${floating ? "  (floating)" : ""}`
+    );
+  }
+  return { env: { ...env, services }, images };
+}
+
+// src/target/target.ts
+import { resolve as resolve3 } from "node:path";
+function emptyRuntime(name) {
+  return {
+    name,
+    env: {},
+    dockerContextArgs: [],
+    kubectlContextArgs: [],
+    processEnv: {}
+  };
+}
+function resolveTarget(config, name, rootDir) {
+  const cfg = config.targets?.[name];
+  if (!cfg) {
+    if (name === "local") return emptyRuntime("local");
+    const available = Object.keys(config.targets ?? {}).sort().join(", ") || "(none)";
+    throw new Error(`Unknown target "${name}". Configured targets: ${available}.`);
+  }
+  const processEnv = {};
+  if (cfg.dockerHost) processEnv.DOCKER_HOST = cfg.dockerHost;
+  if (cfg.kubeconfig) processEnv.KUBECONFIG = resolve3(rootDir, cfg.kubeconfig);
+  return {
+    name,
+    backend: cfg.backend,
+    pull: cfg.pull,
+    env: cfg.env ?? {},
+    dockerContextArgs: cfg.dockerContext ? ["--context", cfg.dockerContext] : [],
+    kubectlContextArgs: cfg.kubeContext ? ["--context", cfg.kubeContext] : [],
+    processEnv
+  };
+}
+function applyTarget(action, rt) {
+  let args = action.args;
+  if (action.file === "docker" && rt.dockerContextArgs.length) {
+    args = [...rt.dockerContextArgs, ...args];
+  } else if (action.file === "kubectl" && rt.kubectlContextArgs.length) {
+    args = [...rt.kubectlContextArgs, ...args];
+  }
+  return {
+    file: action.file,
+    args,
+    input: action.input,
+    env: Object.keys(rt.processEnv).length ? rt.processEnv : void 0
+  };
+}
+
+// src/ledger/ledger.ts
+import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "node:fs";
+import { join as join5 } from "node:path";
+var LEDGER_VERSION = 1;
+var MAX_HISTORY = 25;
+function ledgerPath(cacheDir) {
+  return join5(cacheDir, "ledger.json");
+}
+function key(environment, target) {
+  return `${environment}@${target}`;
+}
+function readLedger(cacheDir) {
+  const path = ledgerPath(cacheDir);
+  if (!existsSync3(path)) return { version: LEDGER_VERSION, deployments: {} };
+  try {
+    const parsed = JSON.parse(readFileSync3(path, "utf8"));
+    return { version: LEDGER_VERSION, deployments: parsed.deployments ?? {} };
+  } catch {
+    return { version: LEDGER_VERSION, deployments: {} };
+  }
+}
+function writeLedger(cacheDir, ledger) {
+  mkdirSync(cacheDir, { recursive: true });
+  writeFileSync(ledgerPath(cacheDir), JSON.stringify(ledger, null, 2) + "\n");
+}
+function newDeploymentId(date = /* @__PURE__ */ new Date()) {
+  const stamp = date.toISOString().replace(/[-:]/g, "").replace(/\.\d+Z$/, "Z");
+  const rand = Math.random().toString(36).slice(2, 6);
+  return `${stamp}-${rand}`;
+}
+function appendDeployment(cacheDir, record) {
+  const ledger = readLedger(cacheDir);
+  const k = key(record.environment, record.target);
+  const list = ledger.deployments[k] ?? [];
+  list.push(record);
+  ledger.deployments[k] = list.slice(-MAX_HISTORY);
+  writeLedger(cacheDir, ledger);
+}
+function history(cacheDir, environment, target) {
+  return readLedger(cacheDir).deployments[key(environment, target)] ?? [];
+}
+function latestSuccessful(cacheDir, environment, target) {
+  const list = history(cacheDir, environment, target);
+  for (let i = list.length - 1; i >= 0; i--) {
+    if (list[i].status === "succeeded") return list[i];
+  }
+  return void 0;
+}
+function rollbackTarget(cacheDir, environment, target, toId) {
+  const successful = history(cacheDir, environment, target).filter(
+    (d) => d.status === "succeeded"
+  );
+  if (toId) return successful.find((d) => d.id === toId);
+  return successful.length >= 2 ? successful[successful.length - 2] : void 0;
+}
+
+// src/solution/solution.ts
+async function resolveSolution(config, catalog, name) {
+  const recipe = config.solutions?.[name] ?? await tryCatalog(catalog, name);
+  if (!recipe) {
+    const inline = Object.keys(config.solutions ?? {}).sort().join(", ") || "(none)";
+    throw new Error(
+      `Unknown solution "${name}". Inline solutions: ${inline}. (It may also live in the catalog \u2014 check your catalog sources.)`
+    );
+  }
+  if (!Array.isArray(recipe.environments) || recipe.environments.length === 0) {
+    throw new Error(`Solution "${name}" must list at least one environment.`);
+  }
+  return {
+    name,
+    version: recipe.version,
+    environments: recipe.environments,
+    pins: recipe.pins ?? {},
+    env: recipe.env ?? {},
+    target: recipe.target
+  };
+}
+async function tryCatalog(catalog, name) {
+  try {
+    return await catalog.resolveSolution(name);
+  } catch {
+    return void 0;
+  }
+}
+function applyPins(plan, pins) {
+  for (const [key2, ref] of Object.entries(pins)) {
+    const dot = key2.indexOf(".");
+    const envName = dot === -1 ? key2 : key2.slice(0, dot);
+    const service2 = dot === -1 ? "" : key2.slice(dot + 1);
+    const env = plan.environments.find((e) => e.name === envName);
+    const svc = env && service2 ? env.services[service2] : void 0;
+    if (!svc) {
+      throw new Error(`Solution pin "${key2}" does not match any service (expected "env.service").`);
+    }
+    svc.image = ref;
+  }
+}
+
+// src/solution/bundle.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { tmpdir as tmpdir2 } from "node:os";
+import { dirname as dirname2, join as join6 } from "node:path";
+import { execa as execa3 } from "execa";
+import { create as tarCreate, extract as tarExtract } from "tar";
+var BUNDLE_MANIFEST = "manifest.json";
+var BUNDLE_BLOB = "bundle.tar.gz";
+var BUNDLE_ARTIFACT_TYPE = "application/vnd.kaupang.bundle.v1";
+var OCI_PREFIX = "oci://";
+function isOciRef(ref) {
+  return ref.startsWith(OCI_PREFIX);
+}
+function rewriteActionPath(action, from, to) {
+  return { ...action, args: action.args.map((a) => a === from ? to : a) };
+}
+function writeBundle(dir, manifest) {
+  mkdirSync2(dir, { recursive: true });
+  for (const env of manifest.environments) {
+    const abs = join6(dir, env.artifact.relPath);
+    mkdirSync2(dirname2(abs), { recursive: true });
+    writeFileSync2(abs, env.artifact.content);
+  }
+  writeFileSync2(
+    join6(dir, BUNDLE_MANIFEST),
+    JSON.stringify(manifest, null, 2) + "\n"
+  );
+}
+function readBundle(dir) {
+  const path = join6(dir, BUNDLE_MANIFEST);
+  if (!existsSync4(path)) {
+    throw new Error(`Not a kaupang bundle (no ${BUNDLE_MANIFEST}): ${dir}`);
+  }
+  return JSON.parse(readFileSync4(path, "utf8"));
+}
+async function pushBundle(dir, ociRef) {
+  const ref = ociRef.replace(OCI_PREFIX, "");
+  const tmp = mkdtempSync2(join6(tmpdir2(), "kaupang-push-"));
+  try {
+    await tarCreate({ file: join6(tmp, BUNDLE_BLOB), cwd: dir, gzip: true }, ["."]);
+    await oras(
+      ["push", ...orasRegistryArgs(ref), ref, "--artifact-type", BUNDLE_ARTIFACT_TYPE, BUNDLE_BLOB],
+      tmp,
+      `push ${ref}`
+    );
+  } finally {
+    rmSync2(tmp, { recursive: true, force: true });
+  }
+}
+async function pullBundle(ociRef, intoParent) {
+  const ref = ociRef.replace(OCI_PREFIX, "");
+  const tmp = mkdtempSync2(join6(tmpdir2(), "kaupang-pull-"));
+  try {
+    await oras(["pull", ...orasRegistryArgs(ref), ref, "-o", tmp], process.cwd(), `pull ${ref}`);
+    const blob = join6(tmp, BUNDLE_BLOB);
+    if (!existsSync4(blob)) {
+      throw new Error(`OCI artifact ${ref} is not a kaupang bundle (no ${BUNDLE_BLOB}).`);
+    }
+    mkdirSync2(intoParent, { recursive: true });
+    const dest = mkdtempSync2(join6(intoParent, "bundle-"));
+    await tarExtract({ file: blob, cwd: dest });
+    return dest;
+  } finally {
+    rmSync2(tmp, { recursive: true, force: true });
+  }
+}
+async function oras(args, cwd, what) {
+  try {
+    await execa3("oras", args, { cwd, stdio: "inherit" });
+  } catch (err) {
+    const e = err;
+    if (e.code === "ENOENT") {
+      throw new Error(
+        `Pushing/pulling OCI bundles needs the \`oras\` CLI on PATH (https://oras.land).`
+      );
+    }
+    throw new Error(`oras ${what} failed: ${e.message ?? String(err)}`);
+  }
+}
+
+// src/render/plan.ts
+import { consola as consola2 } from "consola";
+var c = {
+  bold: (s) => `\x1B[1m${s}\x1B[0m`,
+  dim: (s) => `\x1B[2m${s}\x1B[0m`,
+  cyan: (s) => `\x1B[36m${s}\x1B[0m`,
+  green: (s) => `\x1B[32m${s}\x1B[0m`
+};
+function renderPlan(plan, ctx, rt) {
+  consola2.log("");
+  consola2.log(
+    `${c.bold("Deployment plan")} for ${c.cyan(plan.target)} ${c.dim(`(backend: ${plan.backend}${rt ? `, target: ${rt.name}` : ""})`)}`
+  );
+  consola2.log("");
+  consola2.log(c.bold("Environment start order:"));
+  plan.environments.forEach((env, i) => {
+    const deps = env.dependsOn.length ? c.dim(`  \u2190 depends on ${env.dependsOn.join(", ")}`) : "";
+    const marker = env.name === plan.target ? c.green("\u25C6") : c.cyan("\u25CF");
+    consola2.log(`  ${i + 1}. ${marker} ${env.name}${deps}`);
+  });
+  consola2.log("");
+  consola2.log(c.bold("Service graph (per environment):"));
+  for (const env of plan.environments) {
+    renderEnvironmentTree(env);
+  }
+  consola2.log("");
+  consola2.log(c.bold("Commands that would run:"));
+  const backend = getBackend(plan.backend);
+  for (const env of plan.environments) {
+    const m = backend.materialize(env, ctx);
+    for (const file of m.files) {
+      consola2.log(`  ${c.dim("write")} ${file.path}`);
+    }
+    for (const action of m.up) {
+      const a = rt ? applyTarget(action, rt) : action;
+      consola2.log(`  ${c.dim("$")} ${a.file} ${a.args.join(" ")}`);
+    }
+  }
+  consola2.log("");
+}
+function renderEnvironmentTree(env) {
+  consola2.log("");
+  consola2.log(`  ${c.cyan(env.name)}`);
+  if (env.order.length === 0) {
+    consola2.log(`  ${c.dim("\u2514\u2500 (no services)")}`);
+    return;
+  }
+  env.waves.forEach((wave, i) => {
+    const isLast = i === env.waves.length - 1;
+    const branch = isLast ? "\u2514\u2500" : "\u251C\u2500";
+    const label = wave.length > 1 ? `${c.dim("parallel")} ` : "";
+    consola2.log(`  ${branch} wave ${i + 1}: ${label}${wave.join(", ")}`);
+    for (const svc of wave) {
+      const deps = env.services[svc]?.dependsOn ?? [];
+      if (deps.length) {
+        const pad = isLast ? "   " : "\u2502  ";
+        consola2.log(`  ${pad}${c.dim(`${svc} \u2192 ${deps.join(", ")}`)}`);
+      }
+    }
+  });
+}
+
+// src/run/deploy.ts
+import { mkdirSync as mkdirSync3, writeFileSync as writeFileSync3 } from "node:fs";
+import { dirname as dirname3 } from "node:path";
+import { consola as consola4 } from "consola";
+
+// src/util/exec.ts
+import { existsSync as existsSync5 } from "node:fs";
+import { delimiter, join as join7 } from "node:path";
+import { execa as execa4 } from "execa";
+import { consola as consola3 } from "consola";
+var verbose = false;
+function setVerbose(value) {
+  verbose = value;
+}
+function echo(command, dryRun) {
+  if (verbose || dryRun) consola3.log(`  ${dim("$")} ${command}`);
+}
+async function run(file, args, opts) {
+  echo(`${file} ${args.join(" ")}`, opts.dryRun);
+  if (opts.dryRun) return;
+  await execa4(file, args, {
+    cwd: opts.cwd,
+    stdio: opts.input ? ["pipe", "inherit", "inherit"] : "inherit",
+    input: opts.input,
+    env: opts.env ? { ...process.env, ...opts.env } : process.env
+  });
+}
+async function hasBinary(file) {
+  if (file.includes("/") || file.includes("\\")) {
+    return existsSync5(file) || existsSync5(`${file}.exe`);
+  }
+  const dirs = (process.env.PATH ?? "").split(delimiter).filter(Boolean);
+  const exts = process.platform === "win32" ? (process.env.PATHEXT ?? ".EXE;.CMD;.BAT;.COM").split(";") : [""];
+  for (const dir of dirs) {
+    for (const ext of exts) {
+      if (existsSync5(join7(dir, `${file}${ext}`))) return true;
+    }
+  }
+  return false;
+}
+async function runShell(command, opts) {
+  echo(command, opts.dryRun);
+  if (opts.dryRun) return;
+  await execa4(command, {
+    shell: true,
+    cwd: opts.cwd,
+    stdio: "inherit",
+    env: opts.env ? { ...process.env, ...opts.env } : process.env
+  });
+}
+function dim(s) {
+  return `\x1B[2m${s}\x1B[0m`;
+}
+var defaultExecutor = { run, runShell, hasBinary };
+function parseDuration(value) {
+  if (typeof value === "number") return value * 1e3;
+  const m = /^(\d+(?:\.\d+)?)\s*(ms|s|m|h)?$/.exec(value.trim());
+  if (!m) throw new Error(`Invalid duration "${value}" (use e.g. "2s", "500ms", "5m").`);
+  const n = Number(m[1]);
+  switch (m[2]) {
+    case "ms":
+      return n;
+    case "m":
+      return n * 6e4;
+    case "h":
+      return n * 36e5;
+    default:
+      return n * 1e3;
+  }
+}
+
+// src/util/hooks.ts
+import { resolve as resolve4 } from "node:path";
+async function runHooks(commands, opts) {
+  const executor = opts.executor ?? defaultExecutor;
+  for (const cmd of commands ?? []) {
+    const norm = typeof cmd === "string" ? { run: cmd } : cmd;
+    await executor.runShell(norm.run, {
+      cwd: norm.cwd ? resolve4(opts.rootDir, norm.cwd) : opts.rootDir,
+      env: norm.env,
+      dryRun: opts.dryRun
+    });
+  }
+}
+
+// src/run/progress.ts
+var bold = (s) => `\x1B[1m${s}\x1B[0m`;
+var dim2 = (s) => `\x1B[2m${s}\x1B[0m`;
+var cyan = (s) => `\x1B[36m${s}\x1B[0m`;
+var green = (s) => `\x1B[32m${s}\x1B[0m`;
+var red = (s) => `\x1B[31m${s}\x1B[0m`;
+function servicesLabel(env) {
+  if (env.order.length === 0) return "(no services)";
+  return env.waves.map((wave) => wave.join(", ")).join(" \u2192 ");
+}
+function renderQueue(plan, target) {
+  const n = plan.environments.length;
+  const width = Math.max(...plan.environments.map((e) => e.name.length));
+  const lines = [
+    "",
+    `${bold("\u26F5 Voyage")} to ${cyan(plan.target)} ${dim2(`\xB7 ${plan.backend} \u2192 ${target}`)}`,
+    dim2(`   queue \xB7 ${n} environment${n === 1 ? "" : "s"}`)
+  ];
+  plan.environments.forEach((env, i) => {
+    const dep = env.dependsOn.length ? dim2(`  \u2190 ${env.dependsOn.join(", ")}`) : "";
+    lines.push(
+      `     ${dim2("\u25CB")} ${dim2(`${i + 1}/${n}`)}  ${cyan(env.name.padEnd(width))}  ${dim2(servicesLabel(env))}${dep}`
+    );
+  });
+  lines.push("");
+  return lines.join("\n");
+}
+function renderStepStart(i, total, env) {
+  return `${cyan("\u25B6")} ${dim2(`[${i}/${total}]`)} ${bold(env.name)} ${dim2("\u2026")}`;
+}
+function renderStepDone(i, total, env, ms) {
+  return `${green("\u2714")} ${dim2(`[${i}/${total}]`)} ${env.name} ${dim2(`(${fmtMs(ms)})`)}`;
+}
+function renderStepFailed(i, total, env) {
+  return `${red("\u2716")} ${dim2(`[${i}/${total}]`)} ${env.name} ${red("failed")}`;
+}
+function renderSummary(plan, target, ms) {
+  const n = plan.environments.length;
+  const names = plan.environments.map((e) => e.name).join(", ");
+  return (
+    // Two spaces: the 🛖 emoji is rendered double-width and swallows a single
+    // trailing space in many terminals, gluing it to the name.
+    `${green("\u{1F6D6}")}  ${bold(plan.target)} ${dim2("stands on")} ${cyan(target)} ${dim2(`\xB7 ${n}/${n} up (${fmtMs(ms)})`)}
+     ${dim2(names)}`
+  );
+}
+function fmtMs(ms) {
+  return ms < 1e3 ? `${ms}ms` : `${(ms / 1e3).toFixed(1)}s`;
+}
+
+// src/run/deploy.ts
+async function deployPlan(loaded, plan, rt, opts, executor = defaultExecutor) {
+  const backendName = plan.backend;
+  const backend = getBackend(backendName);
+  const ctx = makeContext(loaded, { pull: opts.pull, targetEnv: opts.targetEnv });
+  const records = [];
+  const binary = backendName === "kubernetes" ? "kubectl" : "docker";
+  if (!await executor.hasBinary(binary)) {
+    consola4.warn(`"${binary}" was not found on PATH \u2014 commands will likely fail.`);
+  }
+  consola4.log(renderQueue(plan, opts.targetName));
+  if (backendName !== "kubernetes") {
+    for (const env of plan.environments) {
+      const serviceEnvs = Object.values(env.services).map((s) => s.env);
+      const needed = requiredSecretVars(loaded.config.globalEnv, opts.targetEnv, env.env, ...serviceEnvs);
+      const missing = needed.filter((v) => process.env[v] === void 0);
+      if (missing.length) {
+        throw new Error(
+          `Missing secret env var(s) for "${env.name}": ${missing.join(", ")}. Set them in your shell or pipeline (Azure: map under the step's env:, e.g. ${missing[0]}: $(${missing[0]})).`
+        );
+      }
+    }
+  }
+  const total = plan.environments.length;
+  const startedAll = Date.now();
+  let step = 0;
+  for (const env of plan.environments) {
+    step++;
+    consola4.log(renderStepStart(step, total, env));
+    const startedStep = Date.now();
+    await runHooks(env.hooks?.beforeUp, { rootDir: ctx.rootDir, executor });
+    let deployEnv = env;
+    let images = [];
+    if (opts.resolve) {
+      const resolved = await resolveEnvironmentImages(env);
+      deployEnv = resolved.env;
+      images = resolved.images;
+    }
+    const m = backend.materialize(deployEnv, ctx);
+    const record = (status) => ({
+      id: newDeploymentId(),
+      environment: env.name,
+      target: opts.targetName,
+      backend: backendName,
+      project: loaded.project,
+      ranAt: (/* @__PURE__ */ new Date()).toISOString(),
+      status,
+      images,
+      files: m.files,
+      up: m.up,
+      down: m.down
+    });
+    try {
+      for (const f of m.files) {
+        mkdirSync3(dirname3(f.path), { recursive: true });
+        writeFileSync3(f.path, f.content);
+      }
+      for (const action of m.up) {
+        const a = applyTarget(action, rt);
+        await executor.run(a.file, a.args, { cwd: ctx.rootDir, input: a.input, env: a.env });
+      }
+    } catch (err) {
+      appendDeployment(loaded.cacheDir, record("failed"));
+      consola4.log(renderStepFailed(step, total, env));
+      throw err;
+    }
+    await runHooks(env.hooks?.afterUp, { rootDir: ctx.rootDir, executor });
+    const ok = record("succeeded");
+    appendDeployment(loaded.cacheDir, ok);
+    records.push(ok);
+    consola4.log(renderStepDone(step, total, env, Date.now() - startedStep));
+  }
+  consola4.log(renderSummary(plan, opts.targetName, Date.now() - startedAll));
+  return records;
+}
+
+// src/run/pipeline.ts
+import { mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
+import { consola as consola5 } from "consola";
+var ACTION_KEYS = ["run", "up", "down", "build", "wait"];
+async function runPipeline(loaded, name, opts, executor = defaultExecutor) {
+  const pipeline = loaded.config.pipelines?.[name];
+  if (!pipeline) {
+    const available = Object.keys(loaded.config.pipelines ?? {}).sort().join(", ") || "(none)";
+    throw new Error(`Unknown pipeline "${name}". Available: ${available}.`);
+  }
+  const stepNames = Object.keys(pipeline.steps);
+  if (stepNames.length === 0) throw new Error(`Pipeline "${name}" has no steps.`);
+  for (const s of stepNames) validateStep(s, pipeline.steps[s]);
+  const deps = new Map(stepNames.map((s) => [s, toArray(pipeline.steps[s].needs)]));
+  const { order, waves } = topoSort(stepNames, deps, "step");
+  if (opts.dryRun) {
+    renderPipeline(name, pipeline, waves, opts.target);
+    return;
+  }
+  consola5.info(`\u{1F6F6} Setting out on voyage "${name}" (${order.join(" \u2192 ")})`);
+  for (const step of order) {
+    consola5.start(`\u2693 leg: ${step}`);
+    await runStep(loaded, pipeline.steps[step], opts.target, executor);
+    consola5.success(step);
+  }
+  consola5.success(`\u{1F37A} Voyage "${name}" complete \u2014 to the feast!`);
+}
+function validateStep(name, step) {
+  const present = ACTION_KEYS.filter((k) => step[k] !== void 0);
+  if (present.length !== 1) {
+    throw new Error(
+      `Pipeline step "${name}" must have exactly one of ${ACTION_KEYS.join(" / ")} (got ${present.length}).`
+    );
+  }
+}
+async function runStep(loaded, step, defaultTarget, executor) {
+  if (step.run !== void 0) {
+    await runHooks([step.run], { rootDir: loaded.rootDir, executor });
+    return;
+  }
+  if (step.wait !== void 0) {
+    await runWait(step.wait);
+    return;
+  }
+  const targetName = step.target ?? defaultTarget ?? process.env.KAUPANG_TARGET ?? "local";
+  const rt = resolveTarget(loaded.config, targetName, loaded.rootDir);
+  const backendName = pickBackend(step.backend, rt.backend, loaded.config.defaultBackend);
+  if (step.up !== void 0) {
+    const plan = resolvePlan(step.up, loaded.environments, backendName);
+    await deployPlan(
+      loaded,
+      plan,
+      rt,
+      {
+        targetName,
+        targetEnv: rt.env,
+        pull: rt.pull ?? loaded.config.defaultPull,
+        resolve: true
+      },
+      executor
+    );
+    return;
+  }
+  if (step.build !== void 0) {
+    await runEnvActions(loaded, step.build, backendName, rt, "build", executor);
+    return;
+  }
+  if (step.down !== void 0) {
+    await runEnvActions(loaded, step.down, backendName, rt, "down", executor);
+    return;
+  }
+}
+async function runEnvActions(loaded, envName, backendName, rt, kind, executor) {
+  const plan = resolvePlan(envName, loaded.environments, backendName);
+  const env = plan.environments.find((e) => e.name === plan.target);
+  const ctx = makeContext(loaded, { targetEnv: rt.env });
+  const m = getBackend(backendName).materialize(env, ctx);
+  const actions = kind === "build" ? m.build : m.down;
+  if (kind === "build" && actions.length === 0) {
+    consola5.info(`  (no build context in "${envName}" \u2014 nothing to build)`);
+    return;
+  }
+  if (kind === "down" && !env) return;
+  if (kind === "build") {
+    for (const f of m.files) {
+      mkdirSync4(dirname4(f.path), { recursive: true });
+      writeFileSync4(f.path, f.content);
+    }
+  }
+  for (const action of actions) {
+    const a = applyTarget(action, rt);
+    await executor.run(a.file, a.args, { cwd: ctx.rootDir, input: a.input, env: a.env });
+  }
+}
+async function runWait(spec) {
+  if (spec.seconds !== void 0) {
+    consola5.log(`  \u23F3 waiting ${spec.seconds}s`);
+    await sleep(spec.seconds * 1e3);
+    return;
+  }
+  if (!spec.http) throw new Error("A `wait` step needs either `http` or `seconds`.");
+  const want = spec.status ?? 200;
+  const interval = parseDuration(spec.interval ?? "2s");
+  const deadline = Date.now() + parseDuration(spec.timeout ?? "60s");
+  consola5.log(`  \u{1F52E} reading the omens at ${spec.http} \u2192 ${want}`);
+  while (Date.now() < deadline) {
+    try {
+      const res = await fetch(spec.http);
+      if (res.status === want) return;
+    } catch {
+    }
+    await sleep(interval);
+  }
+  throw new Error(`Timed out waiting for ${spec.http} to return ${want}.`);
+}
+function pickBackend(step, fromTarget, fallback) {
+  const name = step ?? fromTarget ?? fallback ?? "compose";
+  if (!backendNames.includes(name)) {
+    throw new Error(`Unknown backend "${name}" in pipeline step.`);
+  }
+  return name;
+}
+function renderPipeline(name, pipeline, waves, target) {
+  consola5.log(`
+Pipeline "${name}"${target ? ` \u2192 ${target}` : ""}
+`);
+  waves.forEach((wave, i) => {
+    consola5.log(`  wave ${i + 1}${wave.length > 1 ? " (parallelizable)" : ""}:`);
+    for (const step of wave) {
+      consola5.log(`    - ${step}: ${describe(pipeline.steps[step])}`);
+    }
+  });
+  consola5.log("");
+}
+function describe(step) {
+  if (step.run !== void 0) {
+    return `run ${typeof step.run === "string" ? step.run : step.run.run}`;
+  }
+  if (step.up !== void 0) return `up ${step.up}${step.target ? ` \u2192 ${step.target}` : ""}`;
+  if (step.down !== void 0) return `down ${step.down}`;
+  if (step.build !== void 0) return `build ${step.build}`;
+  if (step.wait?.http) return `wait for ${step.wait.http}`;
+  if (step.wait?.seconds !== void 0) return `wait ${step.wait.seconds}s`;
+  return "(empty)";
+}
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+export {
+  BUNDLE_MANIFEST,
+  appendDeployment,
+  applyPins,
+  applyTarget,
+  backendNames,
+  createCatalogResolver,
+  defaultExecutor,
+  deployPlan,
+  findConfig,
+  getBackend,
+  hasBinary,
+  history,
+  isOciRef,
+  isPinned,
+  isSecret,
+  k8sName,
+  latestSuccessful,
+  loadConfig,
+  makeContext,
+  mergeEnv,
+  newDeploymentId,
+  normalizeEnvironment,
+  parseDuration,
+  pullBundle,
+  pushBundle,
+  readBundle,
+  readLedger,
+  renderComposeEnv,
+  renderPlan,
+  requiredSecretVars,
+  resolveDigest,
+  resolveEnvironmentImages,
+  resolveImage,
+  resolveMultiPlan,
+  resolvePlan,
+  resolveSolution,
+  resolveTarget,
+  rewriteActionPath,
+  rollbackTarget,
+  run,
+  runHooks,
+  runPipeline,
+  runShell,
+  sanitize,
+  setVerbose,
+  stackName,
+  toArray,
+  topoSort,
+  writeBundle
+};