@lantharos/pult 0.0.0-stage → 0.8.0

package/cli.mjs

@@ -0,0 +1,917 @@
+#!/usr/bin/env node
+import { C as HEADER, D as sign, E as parseKey, P as findActionDef, S as kindOf, _ as normalizeFilter, a as collect, c as guards, h as isPendingAttachment, i as validate, k as eachBlock, r as toJsonSchema } from "./schema-CzG8J_9_.mjs";
+import { parseArgs, styleText } from "node:util";
+import { Cron } from "croner";
+import { existsSync, readFileSync, watch } from "node:fs";
+import { glob, mkdir, readFile, writeFile } from "node:fs/promises";
+import net from "node:net";
+import { join, relative } from "node:path";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+//#region ../protocol/src/diff.ts
+function keyed(label, before, after, inner, prefix = "") {
+	const changes = [];
+	for (const name of Object.keys(after)) if (!(name in before)) changes.push({
+		kind: "add",
+		text: `adds ${label} ${prefix}${name}`
+	});
+	for (const name of Object.keys(before)) if (!(name in after)) changes.push({
+		kind: "remove",
+		text: `removes ${label} ${prefix}${name}`
+	});
+	for (const name of Object.keys(after)) {
+		const a = before[name];
+		const b = after[name];
+		if (!a || !b) continue;
+		const nested = inner?.(name, a, b) ?? [];
+		if (nested.length) changes.push(...nested);
+		else if (!sameShape(a, b)) changes.push({
+			kind: "change",
+			text: `changes ${label} ${prefix}${name}`
+		});
+	}
+	return changes;
+}
+function sameShape(a, b) {
+	return stableJson(a, ["source"]) === stableJson(b, ["source"]);
+}
+function stableJson(value, omit = []) {
+	return JSON.stringify(value, (key, inner) => {
+		if (omit.includes(key)) return void 0;
+		if (inner && typeof inner === "object" && !Array.isArray(inner)) return Object.fromEntries(Object.entries(inner).sort(([a], [b]) => a.localeCompare(b)));
+		return inner;
+	});
+}
+function listDelta(subject, verb, before, after) {
+	return [...after.filter((x) => !before.includes(x)).map((x) => ({
+		kind: "grant",
+		text: `${subject} ${verb[0]} ${x}`
+	})), ...before.filter((x) => !after.includes(x)).map((x) => ({
+		kind: "revoke",
+		text: `${subject} ${verb[1]} ${x}`
+	}))];
+}
+function diffManifests(before, after) {
+	const base = before ?? {
+		...after,
+		resources: {},
+		actions: {},
+		inboxes: {},
+		views: {},
+		pages: {},
+		flags: {},
+		roles: {},
+		notify: {},
+		status: null
+	};
+	return [
+		...keyed("status component", base.status?.components ?? {}, after.status?.components ?? {}),
+		...base.status && after.status && !sameShape({
+			...base.status,
+			components: null
+		}, {
+			...after.status,
+			components: null
+		}) ? [{
+			kind: "change",
+			text: "changes the status page"
+		}] : [],
+		...keyed("resource", base.resources, after.resources, (name, a, b) => {
+			const actions = keyed("action", a.actions, b.actions, actionChanges(`${name}.`), `${name}.`);
+			return [...sameShape({
+				...a,
+				actions: null
+			}, {
+				...b,
+				actions: null
+			}) ? [] : [{
+				kind: "change",
+				text: `changes resource ${name}`
+			}], ...actions];
+		}),
+		...keyed("action", base.actions, after.actions, actionChanges("")),
+		...keyed("inbox", base.inboxes, after.inboxes),
+		...keyed("view", base.views, after.views),
+		...keyed("page", base.pages, after.pages),
+		...keyed("flag", base.flags, after.flags, (name, a, b) => a.approval !== b.approval ? [{
+			kind: "change",
+			text: `flag ${name} ${b.approval ? "now needs" : "no longer needs"} a second approver`
+		}] : []),
+		...keyed("notification", base.notify, after.notify),
+		...keyed("role", base.roles, after.roles, (name, a, b) => {
+			const role = `role ${name}`;
+			return [
+				...listDelta(role, ["gains", "loses"], a.actions, b.actions),
+				...listDelta(role, ["sees inbox", "no longer sees inbox"], a.inboxes, b.inboxes),
+				...listDelta(role, ["sees resource", "no longer sees resource"], a.resources, b.resources),
+				...listDelta(role, ["sees page", "no longer sees page"], a.pages, b.pages),
+				...listDelta(role, ["can change flag", "can no longer change flag"], a.flags, b.flags),
+				...a.status !== b.status ? [{
+					kind: b.status ? "grant" : "revoke",
+					text: `${role} ${b.status ? "can" : "can no longer"} post to the status page`
+				}] : [],
+				...a.reveal !== b.reveal ? [{
+					kind: b.reveal ? "grant" : "revoke",
+					text: `${role} ${b.reveal ? "can" : "can no longer"} reveal sensitive fields`
+				}] : []
+			];
+		})
+	];
+}
+function actionChanges(prefix) {
+	return (name, a, b) => {
+		const action = `action ${prefix}${name}`;
+		return [
+			...a.danger !== b.danger ? [{
+				kind: "change",
+				text: `${action} danger ${a.danger} → ${b.danger}`
+			}] : [],
+			...a.approval !== b.approval ? [{
+				kind: "change",
+				text: `${action} ${b.approval ? "now needs" : "no longer needs"} a second approver`
+			}] : [],
+			...a.schedule?.cron !== b.schedule?.cron ? [{
+				kind: "change",
+				text: b.schedule ? `${action} runs on "${b.schedule.cron}"` : `${action} no longer runs on a schedule`
+			}] : []
+		];
+	};
+}
+//#endregion
+//#region ../protocol/src/checks.ts
+const COLUMNS = [
+	"title",
+	"state",
+	"occurrences",
+	"users",
+	"lastSeen",
+	"firstSeen",
+	"assignee",
+	"tags",
+	"due"
+];
+function checkColumns(source, inbox, columns, problems) {
+	for (const column of columns) {
+		if (COLUMNS.includes(column)) continue;
+		const field = column.startsWith("data.") ? column.slice(5) : null;
+		if (field && inbox.data?.properties?.[field]) continue;
+		problems.push({
+			source,
+			message: `column "${column}" doesn't exist on inbox data`
+		});
+	}
+}
+function checkManifest(manifest) {
+	const problems = [];
+	const actionExists = (id) => id.endsWith(".*") ? Boolean(manifest.resources[id.slice(0, -2)]) : Boolean(findActionDef(manifest, id));
+	for (const [name, action] of Object.entries(manifest.actions)) {
+		if (name.includes(".") || name.startsWith("flag:")) problems.push({
+			source: action.source,
+			message: `action "${name}" can't contain "." or start with "flag:"`
+		});
+		if (action.schedule) checkSchedule(name, action, problems);
+	}
+	for (const [name, page] of Object.entries(manifest.pages)) if (page.blocks) checkBlocks(manifest, page.source, `page ${name}`, page.blocks, problems);
+	if (manifest.status) checkStatus(manifest, problems);
+	for (const [name, flag] of Object.entries(manifest.flags)) if (flag.target && !manifest.resources[flag.target]) problems.push({
+		source: flag.source,
+		message: `flag ${name} targets unknown resource "${flag.target}"`
+	});
+	for (const [name, resource] of Object.entries(manifest.resources)) {
+		for (const [relation, def] of Object.entries(resource.related)) if (!manifest.resources[def.resource]) problems.push({
+			source: resource.source,
+			message: `${name}.${relation} points at unknown resource "${def.resource}"`
+		});
+		for (const [key, action] of Object.entries(resource.actions)) {
+			const inputs = action.input?.properties ?? {};
+			for (const field of [...Object.keys(action.pick), ...action.choices]) if (!inputs[field]) problems.push({
+				source: action.source,
+				message: `${name}.${key} has no input field "${field}"`
+			});
+			for (const [field, target] of Object.entries(action.pick)) if (!manifest.resources[target]) problems.push({
+				source: action.source,
+				message: `${name}.${key} picks ${field} from unknown resource "${target}"`
+			});
+			else if (!manifest.resources[target].searchable) problems.push({
+				source: action.source,
+				message: `${name}.${key} picks ${field} from ${target}, which needs a find function to be searchable`
+			});
+		}
+	}
+	for (const role of Object.values(manifest.roles)) for (const id of role.actions) if (!actionExists(id)) problems.push({
+		source: role.source,
+		message: `grants unknown action ${id}`
+	});
+	for (const inbox of Object.values(manifest.inboxes)) {
+		checkColumns(inbox.source, inbox, inbox.columns, problems);
+		for (const state of inbox.reopen) if (!inbox.states.includes(state)) problems.push({
+			source: inbox.source,
+			message: `reopens from unknown state "${state}"`
+		});
+		for (const rule of inbox.triage?.rules ?? []) for (const decision of rule.then) {
+			if (decision.type === "state" && !inbox.states.includes(decision.state)) problems.push({
+				source: inbox.source,
+				message: `${rule.name} moves items to unknown state "${decision.state}"`
+			});
+			if (decision.type !== "run") continue;
+			const def = findActionDef(manifest, decision.action);
+			if (!def) problems.push({
+				source: inbox.source,
+				message: `triage runs unknown action ${decision.action}`
+			});
+			else if (def.approval) problems.push({
+				source: inbox.source,
+				message: `triage runs ${decision.action}, which needs a second approver, so triage can't run it`
+			});
+			else if (def.danger !== "none" && !def.automatable) problems.push({
+				source: inbox.source,
+				message: `triage runs ${decision.action}, which needs a human (danger "${def.danger}"). Set automatable: true on the action to allow it.`
+			});
+		}
+	}
+	for (const view of Object.values(manifest.views)) {
+		const inbox = manifest.inboxes[view.inbox];
+		checkColumns(view.source, inbox, view.columns, problems);
+		for (const state of view.filter.state ?? []) if (!inbox.states.includes(state)) problems.push({
+			source: view.source,
+			message: `filters on unknown state "${state}"`
+		});
+	}
+	return problems;
+}
+function checkSchedule(name, action, problems) {
+	const { cron, timezone } = action.schedule;
+	try {
+		new Cron(cron, {
+			timezone: timezone ?? void 0,
+			paused: true
+		});
+	} catch (error) {
+		problems.push({
+			source: action.source,
+			message: `${name} has an invalid schedule: ${error.message}`
+		});
+	}
+	if (action.input?.required?.length) problems.push({
+		source: action.source,
+		message: `${name} runs on a schedule, so ${action.input.required.join(", ")} need defaults in its input`
+	});
+	if (action.approval) problems.push({
+		source: action.source,
+		message: `${name} runs on a schedule, so it can't need a second approver`
+	});
+}
+const COMPONENT = /^[a-z0-9][a-z0-9-]*$/;
+const WEB_ADDRESS = /^https?:\/\/[^\s/$.?#].\S*$/;
+const CSS_LIMIT = 5e4;
+function checkStatus(manifest, problems) {
+	const status = manifest.status;
+	const problem = (message) => problems.push({
+		source: status.source,
+		message: `status page ${message}`
+	});
+	const components = Object.entries(status.components);
+	if (!components.length) problem("needs at least one component");
+	for (const [name, component] of components) {
+		if (!COMPONENT.test(name)) problem(`component "${name}" should be lowercase letters, numbers and dashes`);
+		if (component.monitored && component.check) problem(`component ${name} can follow your app or a check, not both`);
+		if (component.check && !WEB_ADDRESS.test(component.check)) problem(`component ${name} checks "${component.check}", which isn't a web address`);
+	}
+	for (const recipient of status.alert) if ("role" in recipient && !manifest.roles[recipient.role]) problem(`alerts role "${recipient.role}", which doesn't exist`);
+	if (status.after < 6e4) problem("waits less than a minute before calling your app down. Use 1m or more.");
+	for (const [what, url] of [
+		["logo", status.logo?.light],
+		["dark logo", status.logo?.dark],
+		["website", status.website]
+	]) if (url && !WEB_ADDRESS.test(url)) problem(`${what} "${url}" isn't a web address`);
+	if (status.css && status.css.length > CSS_LIMIT) problem(`css is ${Math.ceil(status.css.length / 1e3)} KB. Keep it under ${CSS_LIMIT / 1e3} KB.`);
+}
+function checkBlocks(manifest, source, owner, blocks, problems) {
+	const problem = (message) => problems.push({
+		source,
+		message: `${owner} ${message}`
+	});
+	const action = (id) => {
+		if (!findActionDef(manifest, id)) problem(`uses unknown action ${id}`);
+	};
+	eachBlock(blocks, (block) => {
+		if (block.type === "actions") for (const button of block.actions) action(button.action);
+		if (block.type === "form") action(block.form.action);
+		if (block.type === "flag" && !manifest.flags[block.flag]) problem(`shows unknown flag ${block.flag}`);
+		if ((block.type === "count" || block.type === "items" || block.type === "chart") && "inbox" in block) {
+			if (!manifest.inboxes[block.inbox]) problem(`shows unknown inbox ${block.inbox}`);
+		}
+		if (block.type === "fields") {
+			for (const { value } of block.fields) if (value && typeof value === "object" && "edit" in value) action(value.edit.action);
+		}
+	});
+}
+//#endregion
+//#region src/build/check.ts
+function check(manifest, impurities) {
+	return [...impurities.map(({ file, effect }) => ({
+		source: file,
+		message: `has a top-level side effect: ${effect}. Move it inside a handler or import it lazily.`
+	})), ...checkManifest(manifest)];
+}
+//#endregion
+//#region src/build/load.ts
+const CONFIG_FILES = [
+	"pult.config.ts",
+	"pult.config.mts",
+	"pult.config.js",
+	"pult.config.mjs"
+];
+function findConfig(root) {
+	const file = CONFIG_FILES.map((name) => join(root, name)).find(existsSync);
+	if (!file) throw new Error(`No pult.config.ts in ${root}`);
+	return file;
+}
+async function loadProject(root, importer) {
+	const config = (await importer(findConfig(root))).default;
+	if (kindOf(config) !== "config") throw new Error("pult.config.ts must default-export defineConfig({ ... })");
+	const { include } = config.options;
+	const files = /* @__PURE__ */ new Set();
+	for (const pattern of include) for await (const file of glob(pattern, {
+		cwd: root,
+		exclude: (name) => name.includes("node_modules")
+	})) files.add(relative(root, join(root, file)));
+	const impurities = [];
+	const modules = [];
+	for (const file of [...files].sort()) {
+		const restore = trap((effect) => impurities.push({
+			file,
+			effect
+		}));
+		try {
+			modules.push(await importer(join(root, file)));
+		} catch (error) {
+			if (!impurities.some((impurity) => impurity.file === file)) throw error;
+		} finally {
+			restore();
+		}
+	}
+	return {
+		root,
+		config,
+		files: [...files].sort(),
+		modules,
+		impurities
+	};
+}
+function trap(report) {
+	const original = {
+		fetch: globalThis.fetch,
+		WebSocket: globalThis.WebSocket,
+		setInterval: globalThis.setInterval,
+		connect: net.Socket.prototype.connect
+	};
+	const refuse = (effect) => {
+		report(effect);
+		return /* @__PURE__ */ new Error(`Definition files must not ${effect} when imported`);
+	};
+	globalThis.fetch = Object.assign((input) => Promise.reject(refuse(`fetch ${input instanceof Request ? input.url : input}`)), original.fetch);
+	globalThis.WebSocket = class {
+		constructor(url) {
+			throw refuse(`open a WebSocket to ${url}`);
+		}
+	};
+	globalThis.setInterval = ((..._) => {
+		throw refuse("start an interval");
+	});
+	net.Socket.prototype.connect = function() {
+		throw refuse("open a network connection");
+	};
+	return () => {
+		globalThis.fetch = original.fetch;
+		globalThis.WebSocket = original.WebSocket;
+		globalThis.setInterval = original.setInterval;
+		net.Socket.prototype.connect = original.connect;
+	};
+}
+//#endregion
+//#region src/build/manifest.ts
+const sources = /* @__PURE__ */ new Map();
+function lines(file) {
+	let cached = sources.get(file);
+	if (!cached) {
+		cached = readFileSync(file, "utf8").split("\n");
+		sources.set(file, cached);
+	}
+	return cached;
+}
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var Locator = class {
+	root;
+	constructor(root) {
+		this.root = root;
+	}
+	locate(origin, pattern, after = 0) {
+		const file = relative(this.root, origin.file);
+		if (!pattern || !origin.file) return `${file}:${origin.line}`;
+		const index = lines(origin.file).findIndex((line, i) => i >= after && pattern.test(line));
+		return `${file}:${index === -1 ? origin.line : index + 1}`;
+	}
+	call(kind, origin, name) {
+		return this.locate(origin, new RegExp(`\\b${kind}\\(\\s*["'\`]${escapeRegExp(name)}["'\`]`));
+	}
+};
+function humanize(name) {
+	const spaced = name.replace(/[-_]+/g, " ").replace(/([a-z])([A-Z])/g, "$1 $2");
+	return spaced.charAt(0).toUpperCase() + spaced.slice(1);
+}
+function pluralize(label) {
+	return /(s|x|sh|ch)$/.test(label) ? `${label}es` : /[^aeiou]y$/.test(label) ? `${label.slice(0, -1)}ies` : `${label}s`;
+}
+function actionDef(source, key, action) {
+	const { options } = action;
+	return {
+		source,
+		label: options.label ?? humanize(key),
+		description: options.description,
+		danger: options.danger ?? "none",
+		input: options.input ? toJsonSchema(options.input) : null,
+		preview: Boolean(options.preview),
+		automatable: options.automatable ?? false,
+		approval: options.approval ?? false,
+		contextual: Boolean(options.when || options.defaults),
+		background: options.background ?? false,
+		pick: options.pick ?? {},
+		choices: Object.keys(options.choices ?? {}),
+		schedule: options.schedule ? schedule(options.schedule) : null
+	};
+}
+function schedule(input) {
+	return typeof input === "string" ? {
+		cron: input,
+		timezone: null
+	} : {
+		cron: input.cron,
+		timezone: input.timezone ?? null
+	};
+}
+function resourceDef(locator, resource) {
+	const source = locator.call("resource", resource.origin, resource.name);
+	const line = Number(source.split(":").pop()) - 1;
+	const label = resource.options.label ?? humanize(resource.name);
+	const actions = {};
+	for (const [key, action] of Object.entries(resource.actions)) {
+		if (kindOf(action) !== "action") continue;
+		const keyPattern = new RegExp(`(^|[\\s{,"'])${escapeRegExp(key)}["']?\\s*:\\s*action\\(`);
+		actions[key] = actionDef(locator.locate(resource.origin, keyPattern, line), key, action);
+	}
+	return {
+		source,
+		label,
+		plural: resource.options.plural ?? pluralize(label),
+		icon: resource.options.icon ?? "box",
+		searchable: Boolean(resource.options.find),
+		list: resource.options.list ? { filters: resource.options.list.filters ? toJsonSchema(resource.options.list.filters) : null } : null,
+		related: Object.fromEntries(Object.entries(resource.options.related ?? {}).map(([name, relation]) => [name, {
+			resource: relation.resource,
+			label: relation.label ?? humanize(name)
+		}])),
+		actions
+	};
+}
+function inboxDef(locator, inbox) {
+	const { options } = inbox;
+	const intake = options.intake === true ? {} : options.intake || null;
+	const label = options.label ?? humanize(inbox.name);
+	return {
+		source: locator.call("inbox", inbox.origin, inbox.name),
+		label,
+		icon: options.icon ?? "inbox",
+		resource: options.resource?.name ?? null,
+		layout: options.layout ?? "list",
+		states: inbox.states,
+		closed: inbox.closed,
+		reopen: options.reopenOn ? options.reopenFrom ?? inbox.closed : [],
+		data: options.data ? toJsonSchema(options.data) : null,
+		columns: options.columns ?? defaultColumns(options.layout ?? "list"),
+		intake: intake && {
+			title: intake.title ?? label,
+			description: intake.description
+		},
+		triage: options.triage ? {
+			instructions: options.triage.instructions,
+			questions: options.triage.questions,
+			rules: options.triage.rules.map((rule, index) => ({
+				name: rule.name ?? `Rule ${index + 1}`,
+				live: rule.live ?? false,
+				then: [rule.then].flat()
+			}))
+		} : null,
+		reply: Boolean(options.reply),
+		hooks: { state: Boolean(options.onState) },
+		sla: Object.fromEntries(Object.entries(options.sla ?? {}).map(([state, duration]) => [state, milliseconds(duration)]))
+	};
+}
+const UNITS = {
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+function milliseconds(duration) {
+	const match = /^(\d+(?:\.\d+)?)([mhd])$/.exec(duration);
+	if (!match) throw new Error(`"${duration}" isn't a duration. Use something like "30m", "4h" or "2d".`);
+	return Number(match[1]) * UNITS[match[2]];
+}
+function defaultColumns(layout) {
+	return layout === "table" ? [
+		"title",
+		"occurrences",
+		"users",
+		"lastSeen"
+	] : ["title", "lastSeen"];
+}
+function viewDef(locator, view) {
+	const { options } = view;
+	return {
+		source: locator.call("view", view.origin, view.name),
+		label: options.label ?? humanize(view.name),
+		inbox: options.inbox.name,
+		filter: normalizeFilter(options.filter),
+		layout: options.layout ?? options.inbox.options.layout ?? "list",
+		columns: options.columns ?? options.inbox.options.columns ?? defaultColumns(options.layout ?? "list"),
+		sort: options.sort ?? "-lastSeen"
+	};
+}
+function pageDef(locator, page) {
+	const { options } = page;
+	return {
+		source: page.name === "home" ? locator.locate(page.origin) : locator.call("page", page.origin, page.name),
+		label: options.label ?? humanize(page.name),
+		icon: options.icon ?? "layout",
+		params: options.params ? toJsonSchema(options.params) : null,
+		blocks: typeof options.render === "function" ? null : staticBlocks(page.name, options.render)
+	};
+}
+function staticBlocks(page, blocks) {
+	if (blocks.some(isPendingAttachment)) throw new Error(`Page "${page}" attaches file data. Render it from a function instead.`);
+	return JSON.parse(JSON.stringify(blocks));
+}
+function flagDef(locator, flag) {
+	const { options } = flag;
+	return {
+		source: locator.call("flag", flag.origin, flag.name),
+		label: options.label ?? humanize(flag.name),
+		description: options.description,
+		value: options.value ? toJsonSchema(options.value) : { type: "boolean" },
+		default: JSON.parse(JSON.stringify(options.default ?? null)),
+		target: options.target?.name ?? null,
+		attributes: options.attributes ? toJsonSchema(options.attributes) : null,
+		guards: guards(flag).map((guard) => ({
+			inbox: guard.inbox.name,
+			perHour: guard.perHour,
+			then: guard.then ?? "pause"
+		})),
+		danger: options.danger ?? "none",
+		approval: options.approval ?? false
+	};
+}
+function notifyDef(locator, rule) {
+	return {
+		source: locator.call("notify", rule.origin, rule.name),
+		inboxes: rule.options.inboxes.map((inbox) => inbox.name),
+		on: rule.options.on,
+		to: rule.options.to.map((recipient) => "channel" in recipient ? { channel: recipient.channel } : { role: recipient.name })
+	};
+}
+function logo(value) {
+	if (value === void 0) return null;
+	return typeof value === "string" ? {
+		light: value,
+		dark: value
+	} : value;
+}
+function statusDef(locator, page, config) {
+	return {
+		source: locator.locate(page.origin, /\bstatus\(/),
+		title: page.options.title ?? humanize(config.options.project),
+		logo: logo(page.options.logo),
+		website: page.options.website ?? null,
+		css: page.options.css?.trim() || null,
+		components: Object.fromEntries(Object.entries(page.options.components).map(([name, component]) => [name, typeof component === "string" ? {
+			label: component,
+			description: null,
+			monitored: false,
+			check: null
+		} : {
+			label: component.label,
+			description: component.description ?? null,
+			monitored: component.monitored ?? false,
+			check: component.check ?? null
+		}])),
+		alert: (page.options.alert ?? []).map((recipient) => "channel" in recipient ? { channel: recipient.channel } : { role: recipient.name }),
+		after: milliseconds(page.options.after ?? "2m")
+	};
+}
+function assemble(root, definitions, config) {
+	const locator = new Locator(root);
+	const map = (source, convert) => Object.fromEntries([...source].sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => [name, convert(value)]));
+	const roles = map(definitions.roles, (role) => ({
+		source: locator.call("role", role.origin, role.name),
+		label: role.options.label ?? humanize(role.name),
+		inboxes: (role.options.inboxes ?? []).map((inbox) => inbox.name),
+		resources: (role.options.resources ?? []).map((resource) => resource.name),
+		actions: (role.options.actions ?? []).map((action) => action.id),
+		pages: (role.options.pages ?? []).map((page) => page.name),
+		flags: (role.options.flags ?? []).map((flag) => flag.name),
+		reveal: role.options.reveal ?? false,
+		status: role.options.status ?? false
+	}));
+	const manifest = {
+		project: config.options.project,
+		environments: config.options.environments,
+		sync: config.options.sync,
+		delivery: config.options.delivery,
+		resources: map(definitions.resources, (resource) => resourceDef(locator, resource)),
+		actions: map(definitions.actions, (action) => actionDef(locator.call("action", action.origin, action.name), action.name, action)),
+		inboxes: map(definitions.inboxes, (inbox) => inboxDef(locator, inbox)),
+		views: map(definitions.views, (view) => viewDef(locator, view)),
+		pages: map(definitions.pages, (page) => pageDef(locator, page)),
+		flags: map(definitions.flags, (flag) => flagDef(locator, flag)),
+		roles,
+		notify: map(definitions.notify, (rule) => notifyDef(locator, rule)),
+		status: definitions.status && statusDef(locator, definitions.status, config)
+	};
+	return {
+		...manifest,
+		version: hash(stableJson(manifest))
+	};
+}
+function hash(text) {
+	return createHash("sha256").update(text).digest("hex").slice(0, 12);
+}
+//#endregion
+//#region src/build/codegen.ts
+const OUT_DIR = ".pult";
+function projectModule(files) {
+	return [
+		"// Generated by `pult build`. Commit this file; don't edit it.",
+		"import type { Manifest, Project } from \"pult\"",
+		"import manifest from \"./manifest.json\" with { type: \"json\" }",
+		"",
+		"export default {",
+		"  manifest: manifest as Manifest,",
+		"  modules: {",
+		...files.map((file) => `    ${JSON.stringify(file)}: () => import(${JSON.stringify(`../${file}`)}),`),
+		"  },",
+		"} satisfies Project",
+		""
+	].join("\n");
+}
+async function readManifest(root) {
+	try {
+		return JSON.parse(await readFile(join(root, OUT_DIR, "manifest.json"), "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function writeOutput(root, manifest, files) {
+	const dir = join(root, OUT_DIR);
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(dir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+	await writeFile(join(dir, "index.ts"), projectModule(files));
+}
+//#endregion
+//#region src/build/index.ts
+async function build(root, importer) {
+	const project = await loadProject(root, importer);
+	const definitions = collect(project.modules);
+	const manifest = assemble(root, definitions, project.config);
+	const problems = [...check(manifest, project.impurities), ...await checkDefaults(definitions, manifest)];
+	return {
+		manifest,
+		files: project.files,
+		problems
+	};
+}
+async function checkDefaults(definitions, manifest) {
+	const problems = [];
+	for (const [name, flag] of definitions.flags) {
+		if (!flag.options.value) continue;
+		await validate(flag.options.value, flag.options.default).catch((error) => problems.push({
+			source: manifest.flags[name].source,
+			message: `flag ${name} defaults to an invalid value: ${error.message}`
+		}));
+	}
+	return problems;
+}
+//#endregion
+//#region src/cli/output.ts
+const dim = (text) => styleText("dim", text);
+const bold = (text) => styleText("bold", text);
+function fail(message) {
+	console.error(`${styleText("red", "✕")} ${message}`);
+	process.exit(1);
+}
+function done(message) {
+	console.log(`${styleText("green", "✓")} ${message}`);
+}
+function printProblems(problems) {
+	for (const { source, message } of problems) console.error(`${styleText("red", "✕")} ${dim(source)} ${message}`);
+}
+const MARK = {
+	add: ["+", "green"],
+	remove: ["-", "red"],
+	change: ["~", "yellow"],
+	grant: ["▲", ["bold", "magenta"]],
+	revoke: ["▼", "magenta"]
+};
+function printChanges(changes) {
+	if (!changes.length) return console.log(dim("  no changes"));
+	for (const change of changes) {
+		const [mark, style] = MARK[change.kind];
+		console.log(`  ${styleText(style, mark)} ${change.text}`);
+	}
+}
+//#endregion
+//#region src/cli/project.ts
+const RUNTIME_MODULES = [
+	"cloudflare:workers",
+	"cloudflare:email",
+	"cloudflare:sockets"
+];
+const STUB = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "../build/stub.ts" : "./stub.mjs", import.meta.url));
+const importer = await (async () => {
+	if (typeof Bun !== "undefined") {
+		const exports = await import(STUB);
+		Bun.plugin({
+			name: "cloudflare-runtime",
+			setup(build) {
+				for (const name of RUNTIME_MODULES) build.module(name, () => ({
+					exports,
+					loader: "object"
+				}));
+			}
+		});
+		return (file) => import(file);
+	}
+	const { createJiti } = await import("jiti");
+	const alias = Object.fromEntries(RUNTIME_MODULES.map((name) => [name, STUB]));
+	const jiti = createJiti(import.meta.url, { alias });
+	return (file) => jiti.import(file);
+})();
+async function buildProject(root) {
+	try {
+		return await build(root, importer);
+	} catch (error) {
+		fail(error.message);
+	}
+}
+var Remote = class {
+	environment;
+	#secret;
+	#url;
+	constructor() {
+		const key = process.env.PULT_KEY;
+		if (!key) fail("Set PULT_KEY to the key of the environment you're targeting");
+		const parsed = parseKey(key);
+		this.environment = parsed.environment;
+		this.#secret = parsed.secret;
+		this.#url = (process.env.PULT_URL ?? "https://app.pult.sh").replace(/\/$/, "");
+	}
+	async #request(method, path, body) {
+		const payload = body === void 0 ? "" : JSON.stringify(body);
+		const signature = await sign(this.#secret, `${method} ${path}`, payload);
+		const response = await fetch(`${this.#url}${path}`, {
+			method,
+			body: method === "POST" ? payload : void 0,
+			headers: {
+				"content-type": "application/json",
+				[HEADER.environment]: this.environment,
+				[HEADER.timestamp]: signature.timestamp,
+				[HEADER.nonce]: signature.nonce,
+				[HEADER.signature]: signature.signature
+			}
+		});
+		const json = await response.json().catch(() => null);
+		if (!response.ok) fail(json?.error ?? `${response.status} ${response.statusText}`);
+		return json;
+	}
+	current() {
+		return this.#request("GET", "/v1/manifest");
+	}
+	deploy(manifest) {
+		return this.#request("POST", "/v1/manifest", manifest);
+	}
+};
+//#endregion
+//#region src/cli/commands/build.ts
+async function buildCommand(root) {
+	const { manifest, files, problems } = await buildProject(root);
+	if (problems.length) {
+		printProblems(problems);
+		fail(`${problems.length} problem${problems.length === 1 ? "" : "s"}, manifest not written`);
+	}
+	await writeOutput(root, manifest, files);
+	done(`manifest ${manifest.version} · ${files.length} files`);
+	return manifest;
+}
+//#endregion
+//#region src/cli/commands/check.ts
+async function checkCommand(root) {
+	const { manifest, problems } = await buildProject(root);
+	printProblems(problems);
+	if (problems.length) fail(`${problems.length} problem${problems.length === 1 ? "" : "s"}`);
+	if ((await readManifest(root))?.version !== manifest.version) fail("The committed manifest is out of date. Run `pult build`.");
+	done(`manifest ${manifest.version} is valid and up to date`);
+}
+//#endregion
+//#region src/cli/commands/deploy.ts
+async function deployCommand(root) {
+	const manifest = await buildCommand(root);
+	const remote = new Remote();
+	const current = await remote.current();
+	if (current.manifest?.version === manifest.version) return done(`${current.name} is already on ${manifest.version}`);
+	console.log(`${bold(current.name)} ${dim(`${current.manifest?.version ?? "empty"} → ${manifest.version}`)}`);
+	printChanges(diffManifests(current.manifest, manifest));
+	await remote.deploy(manifest);
+	done(`deployed ${manifest.version} to ${current.name}`);
+}
+//#endregion
+//#region src/cli/commands/dev.ts
+const IGNORED = /(^|[\\/])(node_modules|\.pult|\.git|dist|build)([\\/]|$)/;
+function devCommand(root) {
+	let running = false;
+	let queued = false;
+	const rebuild = () => {
+		if (running) {
+			queued = true;
+			return;
+		}
+		running = true;
+		spawn(process.execPath, [
+			...process.execArgv,
+			process.argv[1],
+			"build"
+		], {
+			cwd: root,
+			stdio: "inherit"
+		}).on("exit", () => {
+			running = false;
+			if (queued) {
+				queued = false;
+				rebuild();
+			}
+		});
+	};
+	let timer;
+	watch(root, { recursive: true }, (_, file) => {
+		if (!file || IGNORED.test(file) || !/\.(m?[jt]s)$/.test(file)) return;
+		clearTimeout(timer);
+		timer = setTimeout(rebuild, 80);
+	});
+	console.log(dim("watching for changes"));
+	rebuild();
+}
+//#endregion
+//#region src/cli/commands/diff.ts
+async function diffCommand(root) {
+	const { manifest, problems } = await buildProject(root);
+	if (problems.length) {
+		printProblems(problems);
+		fail("Fix the problems above first");
+	}
+	const current = await new Remote().current();
+	console.log(`${bold(current.name)} ${dim(`${current.manifest?.version ?? "empty"} → ${manifest.version}`)}`);
+	printChanges(diffManifests(current.manifest, manifest));
+}
+//#endregion
+//#region src/cli/index.ts
+const USAGE = `pult <command>
+
+  build    compile definitions into .pult/
+  check    type-check references and make sure the manifest is current
+  diff     show what a deploy would change (uses PULT_KEY)
+  deploy   push the manifest to the environment behind PULT_KEY
+  dev      rebuild on every change`;
+const { positionals, values } = parseArgs({
+	allowPositionals: true,
+	options: {
+		cwd: { type: "string" },
+		help: {
+			type: "boolean",
+			short: "h"
+		}
+	}
+});
+const root = values.cwd ?? process.cwd();
+const commands = {
+	build: buildCommand,
+	check: checkCommand,
+	diff: diffCommand,
+	deploy: deployCommand,
+	dev: devCommand
+};
+const command = positionals[0];
+if (values.help || !command) console.log(USAGE);
+else if (!commands[command]) fail(`Unknown command "${command}"\n\n${USAGE}`);
+else await commands[command](root);
+//#endregion
+export {};