@lantharos/pult 0.0.0-stage → 0.9.0

package/cli.mjs

@@ -0,0 +1,1143 @@
+#!/usr/bin/env node
+import { C as traceOrigins, L as findActionDef, M as valuesIn, S as kindOf, _ as normalizeFilter, a as collect, c as guards, d as Transport, h as hasPendingAttachments, i as validate, j as shownValue, k as eachBlock, r as toJsonSchema, x as humanize } from "./schema-DuTVNptF.mjs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { parseArgs, styleText } from "node:util";
+import { Cron } from "croner";
+import { existsSync, readFileSync, watch } from "node:fs";
+import { glob, mkdir, readFile, writeFile } from "node:fs/promises";
+import net from "node:net";
+import { createHash } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { spawn } from "node:child_process";
+//#region ../protocol/src/diff.ts
+function keyed(label, before, after, nested, prefix = "") {
+	const changes = [];
+	for (const name of Object.keys(after)) if (!(name in before)) changes.push({
+		kind: "add",
+		text: `adds ${label} ${prefix}${name}`
+	});
+	for (const name of Object.keys(before)) if (!(name in after)) changes.push({
+		kind: "remove",
+		text: `removes ${label} ${prefix}${name}`
+	});
+	for (const name of Object.keys(after)) {
+		const a = before[name];
+		const b = after[name];
+		if (!a || !b) continue;
+		if (nested) changes.push(...nested.diff(name, a, b));
+		if (!sameShape(a, b, nested?.covers)) changes.push({
+			kind: "change",
+			text: `changes ${label} ${prefix}${name}`
+		});
+	}
+	return changes;
+}
+function sameShape(a, b, covers = []) {
+	return shape(a, covers) === shape(b, covers);
+}
+function shape(definition, covers) {
+	const rest = {
+		...definition,
+		source: void 0
+	};
+	for (const key of covers) rest[key] = void 0;
+	return stableJson(rest);
+}
+function stableJson(value) {
+	return JSON.stringify(value, (_, inner) => inner && typeof inner === "object" && !Array.isArray(inner) ? Object.fromEntries(Object.entries(inner).sort(([a], [b]) => a.localeCompare(b))) : inner);
+}
+function byName(spaces) {
+	return Object.fromEntries(spaces.map((space) => [space.name, space]));
+}
+function listDelta(subject, verb, before, after) {
+	return [...after.filter((x) => !before.includes(x)).map((x) => ({
+		kind: "grant",
+		text: `${subject} ${verb[0]} ${x}`
+	})), ...before.filter((x) => !after.includes(x)).map((x) => ({
+		kind: "revoke",
+		text: `${subject} ${verb[1]} ${x}`
+	}))];
+}
+function toggled(before, after, text, kind) {
+	if (before === after) return [];
+	return [{
+		kind: kind ?? (after ? "grant" : "revoke"),
+		text: text(after)
+	}];
+}
+function delivery(target) {
+	return target.mode === "socket" ? "over a socket" : `to ${target.path}`;
+}
+function projectChanges(before, after) {
+	return [
+		...before.project !== after.project ? [{
+			kind: "change",
+			text: `moves from project ${before.project} to ${after.project}`
+		}] : [],
+		...after.environments.filter((name) => !before.environments.includes(name)).map((name) => ({
+			kind: "add",
+			text: `adds environment ${name}`
+		})),
+		...before.environments.filter((name) => !after.environments.includes(name)).map((name) => ({
+			kind: "remove",
+			text: `removes environment ${name}`
+		})),
+		...before.sync !== after.sync ? [{
+			kind: "change",
+			text: `${after.sync} follows your code instead of ${before.sync}`
+		}] : [],
+		...stableJson(before.delivery) !== stableJson(after.delivery) ? [{
+			kind: "change",
+			text: `sends requests ${delivery(after.delivery)} instead of ${delivery(before.delivery)}`
+		}] : []
+	];
+}
+function diffManifests(before, after) {
+	const base = before ?? {
+		...after,
+		resources: {},
+		actions: {},
+		inboxes: {},
+		views: {},
+		pages: {},
+		flags: {},
+		roles: {},
+		spaces: [],
+		notify: {},
+		status: null
+	};
+	return [
+		...projectChanges(base, after),
+		...keyed("status component", base.status?.components ?? {}, after.status?.components ?? {}),
+		...base.status && after.status && !sameShape(base.status, after.status, ["components"]) ? [{
+			kind: "change",
+			text: "changes the status page"
+		}] : [],
+		...keyed("resource", base.resources, after.resources, {
+			covers: ["actions"],
+			diff: (name, a, b) => keyed("action", a.actions, b.actions, actionChanges(`${name}.`), `${name}.`)
+		}),
+		...keyed("action", base.actions, after.actions, actionChanges("")),
+		...keyed("inbox", base.inboxes, after.inboxes),
+		...keyed("view", base.views, after.views),
+		...keyed("page", base.pages, after.pages),
+		...keyed("flag", base.flags, after.flags, flagChanges),
+		...keyed("space", byName(base.spaces), byName(after.spaces)),
+		...keyed("notification", base.notify, after.notify),
+		...keyed("role", base.roles, after.roles, roleChanges)
+	];
+}
+const flagChanges = {
+	covers: ["danger", "approval"],
+	diff: (name, a, b) => [...a.danger !== b.danger ? [{
+		kind: "change",
+		text: `flag ${name} danger ${a.danger} → ${b.danger}`
+	}] : [], ...toggled(a.approval, b.approval, (now) => `flag ${name} ${now ? "now needs" : "no longer needs"} a second approver`, "change")]
+};
+const roleChanges = {
+	covers: [
+		"actions",
+		"inboxes",
+		"resources",
+		"pages",
+		"flags",
+		"status",
+		"reveal"
+	],
+	diff: (name, a, b) => {
+		const role = `role ${name}`;
+		return [
+			...listDelta(role, ["gains", "loses"], a.actions, b.actions),
+			...listDelta(role, ["sees inbox", "no longer sees inbox"], a.inboxes, b.inboxes),
+			...listDelta(role, ["sees resource", "no longer sees resource"], a.resources, b.resources),
+			...listDelta(role, ["sees page", "no longer sees page"], a.pages, b.pages),
+			...listDelta(role, ["can change flag", "can no longer change flag"], a.flags, b.flags),
+			...toggled(a.status, b.status, (now) => `${role} ${now ? "can" : "can no longer"} post to the status page`),
+			...toggled(a.reveal, b.reveal, (now) => `${role} ${now ? "can" : "can no longer"} reveal sensitive fields`)
+		];
+	}
+};
+function actionChanges(prefix) {
+	return {
+		covers: [
+			"danger",
+			"approval",
+			"automatable",
+			"schedule"
+		],
+		diff: (name, a, b) => {
+			const action = `action ${prefix}${name}`;
+			return [
+				...a.danger !== b.danger ? [{
+					kind: "change",
+					text: `${action} danger ${a.danger} → ${b.danger}`
+				}] : [],
+				...toggled(a.approval, b.approval, (now) => `${action} ${now ? "now needs" : "no longer needs"} a second approver`, "change"),
+				...toggled(a.automatable, b.automatable, (now) => `triage ${now ? "can now" : "can no longer"} run ${action} on its own`),
+				...stableJson(a.schedule) !== stableJson(b.schedule) ? [{
+					kind: "change",
+					text: b.schedule ? `${action} runs on "${b.schedule.cron}"${b.schedule.timezone ? ` in ${b.schedule.timezone}` : ""}` : `${action} no longer runs on a schedule`
+				}] : []
+			];
+		}
+	};
+}
+//#endregion
+//#region package.json
+var version = "0.9.0";
+//#endregion
+//#region ../protocol/src/checks.ts
+const COLUMNS = [
+	"title",
+	"state",
+	"occurrences",
+	"users",
+	"lastSeen",
+	"firstSeen",
+	"assignee",
+	"tags",
+	"due"
+];
+function checkSpaces(manifest, problems) {
+	if (!manifest.spaces.length) return;
+	const homes = new Set(manifest.spaces.map((space) => space.home));
+	const sections = [
+		[
+			"inbox",
+			"inboxes",
+			manifest.inboxes
+		],
+		[
+			"resource",
+			"resources",
+			manifest.resources
+		],
+		[
+			"page",
+			"pages",
+			manifest.pages
+		],
+		[
+			"flag",
+			"flags",
+			manifest.flags
+		]
+	];
+	for (const space of manifest.spaces) {
+		if (space.home && !manifest.pages[space.home]) problems.push({
+			source: space.source,
+			message: `home is unknown page "${space.home}"`
+		});
+		for (const [kind, key, defined] of sections) for (const name of space[key]) if (!defined[name]) problems.push({
+			source: space.source,
+			message: `lists unknown ${kind} "${name}"`
+		});
+		else if (kind === "page" && (name === "home" || homes.has(name))) problems.push({
+			source: space.source,
+			message: `lists page "${name}", which is already a home`
+		});
+	}
+	const navigable = (kind, name) => {
+		if (kind === "page") return name !== "home" && !homes.has(name);
+		if (kind === "resource") return manifest.resources[name].searchable || Boolean(manifest.resources[name].list);
+		return true;
+	};
+	for (const [kind, key, defined] of sections) for (const [name, def] of Object.entries(defined)) {
+		if (!navigable(kind, name)) continue;
+		if (manifest.spaces.some((space) => space[key].includes(name))) continue;
+		problems.push({
+			source: def.source,
+			message: `${kind} ${name} isn't in any space, so only search reaches it`
+		});
+	}
+}
+function checkColumns(source, inbox, columns, problems) {
+	for (const column of columns) {
+		if (COLUMNS.includes(column)) continue;
+		const field = column.startsWith("data.") ? column.slice(5) : null;
+		if (field && inbox.data?.properties?.[field]) continue;
+		problems.push({
+			source,
+			message: `column "${column}" doesn't exist on inbox data`
+		});
+	}
+}
+function checkManifest(manifest) {
+	const problems = [];
+	const actionExists = (id) => id.endsWith(".*") ? Boolean(manifest.resources[id.slice(0, -2)]) : Boolean(findActionDef(manifest, id));
+	for (const [name, action] of Object.entries(manifest.actions)) {
+		if (name.includes(".") || name.startsWith("flag:")) problems.push({
+			source: action.source,
+			message: `action "${name}" can't contain "." or start with "flag:"`
+		});
+		if (action.schedule) checkSchedule(name, action, problems);
+	}
+	for (const [name, page] of Object.entries(manifest.pages)) if (page.blocks) checkBlocks(manifest, page.source, `page ${name}`, page.blocks, problems);
+	if (manifest.status) checkStatus(manifest, problems);
+	for (const [name, flag] of Object.entries(manifest.flags)) {
+		if (flag.target && !manifest.resources[flag.target]) problems.push({
+			source: flag.source,
+			message: `flag ${name} targets unknown resource "${flag.target}"`
+		});
+		for (const guard of flag.guards) if (!(guard.perHour >= 1)) problems.push({
+			source: flag.source,
+			message: `flag ${name} guards ${guard.inbox} with perHour ${guard.perHour}. Use 1 or more.`
+		});
+	}
+	for (const [name, resource] of Object.entries(manifest.resources)) {
+		if (name.includes(".")) problems.push({
+			source: resource.source,
+			message: `resource "${name}" can't contain "."`
+		});
+		for (const [relation, def] of Object.entries(resource.related)) if (!manifest.resources[def.resource]) problems.push({
+			source: resource.source,
+			message: `${name}.${relation} points at unknown resource "${def.resource}"`
+		});
+		for (const [key, action] of Object.entries(resource.actions)) {
+			const inputs = action.input?.properties ?? {};
+			for (const field of [...Object.keys(action.pick), ...action.choices]) if (!inputs[field]) problems.push({
+				source: action.source,
+				message: `${name}.${key} has no input field "${field}"`
+			});
+			for (const [field, target] of Object.entries(action.pick)) if (!manifest.resources[target]) problems.push({
+				source: action.source,
+				message: `${name}.${key} picks ${field} from unknown resource "${target}"`
+			});
+			else if (!manifest.resources[target].searchable) problems.push({
+				source: action.source,
+				message: `${name}.${key} picks ${field} from ${target}, which needs a find function to be searchable`
+			});
+		}
+	}
+	for (const role of Object.values(manifest.roles)) for (const id of role.actions) if (!actionExists(id)) problems.push({
+		source: role.source,
+		message: `grants unknown action ${id}`
+	});
+	for (const inbox of Object.values(manifest.inboxes)) {
+		checkColumns(inbox.source, inbox, inbox.columns, problems);
+		for (const state of inbox.reopen) if (!inbox.states.includes(state)) problems.push({
+			source: inbox.source,
+			message: `reopens from unknown state "${state}"`
+		});
+		for (const rule of inbox.triage?.rules ?? []) for (const decision of rule.then) {
+			if (decision.type === "state" && !inbox.states.includes(decision.state)) problems.push({
+				source: inbox.source,
+				message: `${rule.name} moves items to unknown state "${decision.state}"`
+			});
+			if (decision.type !== "run") continue;
+			const def = findActionDef(manifest, decision.action);
+			if (!def) problems.push({
+				source: inbox.source,
+				message: `triage runs unknown action ${decision.action}`
+			});
+			else if (def.approval) problems.push({
+				source: inbox.source,
+				message: `triage runs ${decision.action}, which needs a second approver, so triage can't run it`
+			});
+			else if (def.danger !== "none" && !def.automatable) problems.push({
+				source: inbox.source,
+				message: `triage runs ${decision.action}, which needs a human (danger "${def.danger}"). Set automatable: true on the action to allow it.`
+			});
+			const missing = (def?.input?.required ?? []).filter((field) => !(field in (decision.input ?? {})));
+			if (missing.length) problems.push({
+				source: inbox.source,
+				message: `triage runs ${decision.action} without ${missing.join(", ")}, which it needs as input`
+			});
+		}
+	}
+	checkSpaces(manifest, problems);
+	for (const view of Object.values(manifest.views)) {
+		const inbox = manifest.inboxes[view.inbox];
+		checkColumns(view.source, inbox, view.columns, problems);
+		for (const state of view.filter.state ?? []) if (!inbox.states.includes(state)) problems.push({
+			source: view.source,
+			message: `filters on unknown state "${state}"`
+		});
+	}
+	return problems;
+}
+function checkSchedule(name, action, problems) {
+	const { cron, timezone } = action.schedule;
+	try {
+		new Cron(cron, {
+			timezone: timezone ?? void 0,
+			paused: true
+		});
+	} catch (error) {
+		problems.push({
+			source: action.source,
+			message: `${name} has an invalid schedule: ${error.message}`
+		});
+	}
+	if (action.input?.required?.length) problems.push({
+		source: action.source,
+		message: `${name} runs on a schedule, so ${action.input.required.join(", ")} need defaults in its input`
+	});
+	if (action.approval) problems.push({
+		source: action.source,
+		message: `${name} runs on a schedule, so it can't need a second approver`
+	});
+}
+const COMPONENT = /^[a-z0-9][a-z0-9-]*$/;
+const WEB_ADDRESS = /^https?:\/\/[^\s/$.?#].\S*$/;
+const CSS_LIMIT = 5e4;
+function checkStatus(manifest, problems) {
+	const status = manifest.status;
+	const problem = (message) => problems.push({
+		source: status.source,
+		message: `status page ${message}`
+	});
+	const components = Object.entries(status.components);
+	if (!components.length) problem("needs at least one component");
+	for (const [name, component] of components) {
+		if (!COMPONENT.test(name)) problem(`component "${name}" should be lowercase letters, numbers and dashes`);
+		if (component.monitored && component.check) problem(`component ${name} can follow your app or a check, not both`);
+		if (component.check && !WEB_ADDRESS.test(component.check)) problem(`component ${name} checks "${component.check}", which isn't a web address`);
+	}
+	for (const recipient of status.alert) if ("role" in recipient && !manifest.roles[recipient.role]) problem(`alerts role "${recipient.role}", which doesn't exist`);
+	if (status.after < 6e4) problem("waits less than a minute before calling your app down. Use 1m or more.");
+	for (const [what, url] of [
+		["logo", status.logo?.light],
+		["dark logo", status.logo?.dark],
+		["website", status.website]
+	]) if (url && !WEB_ADDRESS.test(url)) problem(`${what} "${url}" isn't a web address`);
+	if (status.css && status.css.length > CSS_LIMIT) problem(`css is ${Math.ceil(status.css.length / 1e3)} KB. Keep it under ${CSS_LIMIT / 1e3} KB.`);
+}
+function checkBlocks(manifest, source, owner, blocks, problems) {
+	const problem = (message) => problems.push({
+		source,
+		message: `${owner} ${message}`
+	});
+	const action = (id) => {
+		if (!findActionDef(manifest, id)) problem(`uses unknown action ${id}`);
+	};
+	const resource = (name) => {
+		if (!manifest.resources[name]) problem(`shows unknown resource ${name}`);
+	};
+	const value = (field) => {
+		if (field && typeof field === "object" && "edit" in field) action(field.edit.action);
+		const shown = shownValue(field);
+		if (shown && typeof shown === "object" && "record" in shown) resource(shown.record.resource);
+	};
+	eachBlock(blocks, (block) => {
+		if (block.type === "actions") for (const button of block.actions) action(button.action);
+		if (block.type === "form") action(block.form.action);
+		if (block.type === "record") resource(block.ref.resource);
+		if (block.type === "flag" && !manifest.flags[block.flag]) problem(`shows unknown flag ${block.flag}`);
+		if ((block.type === "count" || block.type === "items" || block.type === "chart") && "inbox" in block) {
+			if (!manifest.inboxes[block.inbox]) problem(`shows unknown inbox ${block.inbox}`);
+		}
+		for (const field of valuesIn(block)) value(field);
+	});
+}
+//#endregion
+//#region src/build/check.ts
+function check(manifest, impurities) {
+	return [...impurities.map(({ file, effect }) => ({
+		source: file,
+		message: `has a top-level side effect: ${effect}. Move it inside a handler or import it lazily.`
+	})), ...checkManifest(manifest)];
+}
+//#endregion
+//#region src/build/load.ts
+const CONFIG_FILES = [
+	"pult.config.ts",
+	"pult.config.mts",
+	"pult.config.js",
+	"pult.config.mjs"
+];
+function findConfig(root) {
+	const file = CONFIG_FILES.map((name) => join(root, name)).find(existsSync);
+	if (!file) throw new Error(`No pult.config.ts in ${root}`);
+	return file;
+}
+function loadProject(root, importer) {
+	return traceOrigins(() => load(root, importer));
+}
+async function load(root, importer) {
+	const config = (await importer(findConfig(root))).default;
+	if (kindOf(config) !== "config") throw new Error("pult.config.ts must default-export defineConfig({ ... })");
+	const { include } = config.options;
+	const files = /* @__PURE__ */ new Set();
+	for (const pattern of include) for await (const file of glob(pattern, {
+		cwd: root,
+		exclude: (name) => name.includes("node_modules")
+	})) files.add(relative(root, join(root, file)));
+	const impurities = [];
+	const modules = [];
+	for (const file of [...files].sort()) {
+		const restore = trap((effect) => impurities.push({
+			file,
+			effect
+		}));
+		try {
+			modules.push(await importer(join(root, file)));
+		} catch (error) {
+			if (!impurities.some((impurity) => impurity.file === file)) throw error;
+		} finally {
+			restore();
+		}
+	}
+	return {
+		root,
+		config,
+		files: [...files].sort(),
+		modules,
+		impurities
+	};
+}
+function trap(report) {
+	const original = {
+		fetch: globalThis.fetch,
+		WebSocket: globalThis.WebSocket,
+		setInterval: globalThis.setInterval,
+		connect: net.Socket.prototype.connect
+	};
+	const refuse = (effect) => {
+		report(effect);
+		return /* @__PURE__ */ new Error(`Definition files must not ${effect} when imported`);
+	};
+	globalThis.fetch = Object.assign((input) => Promise.reject(refuse(`fetch ${input instanceof Request ? input.url : input}`)), original.fetch);
+	globalThis.WebSocket = class {
+		constructor(url) {
+			throw refuse(`open a WebSocket to ${url}`);
+		}
+	};
+	globalThis.setInterval = ((..._) => {
+		throw refuse("start an interval");
+	});
+	net.Socket.prototype.connect = function() {
+		throw refuse("open a network connection");
+	};
+	return () => {
+		globalThis.fetch = original.fetch;
+		globalThis.WebSocket = original.WebSocket;
+		globalThis.setInterval = original.setInterval;
+		net.Socket.prototype.connect = original.connect;
+	};
+}
+//#endregion
+//#region src/build/manifest.ts
+const sources = /* @__PURE__ */ new Map();
+function lines(file) {
+	let cached = sources.get(file);
+	if (!cached) {
+		cached = readFileSync(file, "utf8").split("\n");
+		sources.set(file, cached);
+	}
+	return cached;
+}
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+var Locator = class {
+	root;
+	constructor(root) {
+		this.root = root;
+	}
+	locate(origin, pattern, after = 0) {
+		const file = relative(this.root, origin.file);
+		if (!pattern || !origin.file) return `${file}:${origin.line}`;
+		const index = lines(origin.file).findIndex((line, i) => i >= after && pattern.test(line));
+		return `${file}:${index === -1 ? origin.line : index + 1}`;
+	}
+	call(kind, origin, name) {
+		return this.locate(origin, new RegExp(`\\b${kind}\\(\\s*["'\`]${escapeRegExp(name)}["'\`]`));
+	}
+};
+function pluralize(label) {
+	return /(s|x|sh|ch)$/.test(label) ? `${label}es` : /[^aeiou]y$/.test(label) ? `${label.slice(0, -1)}ies` : `${label}s`;
+}
+function actionDef(source, key, action) {
+	const { options } = action;
+	return {
+		source,
+		label: options.label ?? humanize(key),
+		description: options.description,
+		danger: options.danger ?? "none",
+		input: options.input ? toJsonSchema(options.input) : null,
+		preview: Boolean(options.preview),
+		automatable: options.automatable ?? false,
+		approval: options.approval ?? false,
+		contextual: Boolean(options.when || options.defaults),
+		background: options.background ?? false,
+		pick: options.pick ?? {},
+		choices: Object.keys(options.choices ?? {}),
+		schedule: options.schedule ? schedule(options.schedule) : null
+	};
+}
+function schedule(input) {
+	return typeof input === "string" ? {
+		cron: input,
+		timezone: null
+	} : {
+		cron: input.cron,
+		timezone: input.timezone ?? null
+	};
+}
+function resourceDef(locator, resource) {
+	const source = locator.call("resource", resource.origin, resource.name);
+	const line = Number(source.split(":").pop()) - 1;
+	const label = resource.options.label ?? humanize(resource.name);
+	const actions = {};
+	for (const [key, action] of Object.entries(resource.actions)) {
+		if (kindOf(action) !== "action") continue;
+		const keyPattern = new RegExp(`(^|[\\s{,"'])${escapeRegExp(key)}["']?\\s*:\\s*action\\(`);
+		actions[key] = actionDef(locator.locate(resource.origin, keyPattern, line), key, action);
+	}
+	return {
+		source,
+		label,
+		plural: resource.options.plural ?? pluralize(label),
+		icon: resource.options.icon ?? "box",
+		searchable: Boolean(resource.options.find),
+		list: resource.options.list ? { filters: resource.options.list.filters ? toJsonSchema(resource.options.list.filters) : null } : null,
+		related: Object.fromEntries(Object.entries(resource.options.related ?? {}).map(([name, relation]) => [name, {
+			resource: relation.resource,
+			label: relation.label ?? humanize(name)
+		}])),
+		actions
+	};
+}
+function inboxDef(locator, inbox) {
+	const { options } = inbox;
+	const intake = options.intake === true ? {} : options.intake || null;
+	const label = options.label ?? humanize(inbox.name);
+	return {
+		source: locator.call("inbox", inbox.origin, inbox.name),
+		label,
+		icon: options.icon ?? "inbox",
+		resource: options.resource?.name ?? null,
+		layout: options.layout ?? "list",
+		states: inbox.states,
+		closed: inbox.closed,
+		reopen: options.reopenOn ? options.reopenFrom ?? inbox.closed : [],
+		data: options.data ? toJsonSchema(options.data) : null,
+		columns: options.columns ?? defaultColumns(options.layout ?? "list"),
+		intake: intake && {
+			title: intake.title ?? label,
+			description: intake.description
+		},
+		triage: options.triage ? {
+			instructions: options.triage.instructions,
+			questions: options.triage.questions,
+			rules: options.triage.rules.map((rule, index) => ({
+				name: rule.name ?? `Rule ${index + 1}`,
+				live: rule.live ?? false,
+				then: [rule.then].flat()
+			}))
+		} : null,
+		reply: Boolean(options.reply),
+		hooks: { state: Boolean(options.onState) },
+		sla: Object.fromEntries(Object.entries(options.sla ?? {}).map(([state, duration]) => [state, milliseconds(duration)]))
+	};
+}
+const UNITS = {
+	m: 6e4,
+	h: 36e5,
+	d: 864e5
+};
+function milliseconds(duration) {
+	const match = /^(\d+(?:\.\d+)?)([mhd])$/.exec(duration);
+	if (!match) throw new Error(`"${duration}" isn't a duration. Use something like "30m", "4h" or "2d".`);
+	return Number(match[1]) * UNITS[match[2]];
+}
+function defaultColumns(layout) {
+	return layout === "table" ? [
+		"title",
+		"occurrences",
+		"users",
+		"lastSeen"
+	] : ["title", "lastSeen"];
+}
+function viewDef(locator, view) {
+	const { options } = view;
+	return {
+		source: locator.call("view", view.origin, view.name),
+		label: options.label ?? humanize(view.name),
+		inbox: options.inbox.name,
+		filter: normalizeFilter(options.filter),
+		layout: options.layout ?? options.inbox.options.layout ?? "list",
+		columns: options.columns ?? options.inbox.options.columns ?? defaultColumns(options.layout ?? "list"),
+		sort: options.sort ?? "-lastSeen"
+	};
+}
+function pageDef(locator, page) {
+	const { options } = page;
+	return {
+		source: page.name === "home" ? locator.locate(page.origin) : locator.call("page", page.origin, page.name),
+		label: options.label ?? humanize(page.name),
+		icon: options.icon ?? "layout",
+		params: options.params ? toJsonSchema(options.params) : null,
+		blocks: typeof options.render === "function" ? null : staticBlocks(page.name, options.render)
+	};
+}
+function staticBlocks(page, blocks) {
+	if (hasPendingAttachments(blocks)) throw new Error(`Page "${page}" attaches file data. Render it from a function instead.`);
+	return JSON.parse(JSON.stringify(blocks));
+}
+function flagDef(locator, flag) {
+	const { options } = flag;
+	return {
+		source: locator.call("flag", flag.origin, flag.name),
+		label: options.label ?? humanize(flag.name),
+		description: options.description,
+		value: options.value ? toJsonSchema(options.value) : { type: "boolean" },
+		default: JSON.parse(JSON.stringify(options.default ?? null)),
+		target: options.target?.name ?? null,
+		attributes: options.attributes ? toJsonSchema(options.attributes) : null,
+		guards: guards(flag).map((guard) => ({
+			inbox: guard.inbox.name,
+			perHour: guard.perHour,
+			then: guard.then ?? "pause"
+		})),
+		danger: options.danger ?? "none",
+		approval: options.approval ?? false
+	};
+}
+function spaceDef(locator, space) {
+	const { options } = space;
+	return {
+		name: space.name,
+		source: locator.call("space", space.origin, space.name),
+		label: options.label ?? humanize(space.name),
+		icon: options.icon ?? "layout",
+		home: space.home?.name ?? null,
+		inboxes: (options.inboxes ?? []).map((inbox) => inbox.name),
+		resources: (options.resources ?? []).map((resource) => resource.name),
+		pages: (options.pages ?? []).map((page) => page.name),
+		flags: (options.flags ?? []).map((flag) => flag.name)
+	};
+}
+function byDefinition(a, b) {
+	return a.origin.file.localeCompare(b.origin.file) || a.origin.line - b.origin.line;
+}
+function notifyDef(locator, rule) {
+	return {
+		source: locator.call("notify", rule.origin, rule.name),
+		inboxes: rule.options.inboxes.map((inbox) => inbox.name),
+		on: rule.options.on,
+		to: recipients(rule.options.to)
+	};
+}
+function recipients(list) {
+	return list.map((recipient) => "channel" in recipient ? { channel: recipient.channel } : { role: recipient.name });
+}
+function logo(value) {
+	if (value === void 0) return null;
+	return typeof value === "string" ? {
+		light: value,
+		dark: value
+	} : value;
+}
+function statusDef(locator, page, config) {
+	return {
+		source: locator.locate(page.origin, /\bstatus\(/),
+		title: page.options.title ?? humanize(config.options.project),
+		logo: logo(page.options.logo),
+		website: page.options.website ?? null,
+		css: page.options.css?.trim() || null,
+		components: Object.fromEntries(Object.entries(page.options.components).map(([name, component]) => [name, typeof component === "string" ? {
+			label: component,
+			description: null,
+			monitored: false,
+			check: null
+		} : {
+			label: component.label,
+			description: component.description ?? null,
+			monitored: component.monitored ?? false,
+			check: component.check ?? null
+		}])),
+		alert: recipients(page.options.alert ?? []),
+		after: milliseconds(page.options.after ?? "2m")
+	};
+}
+function assemble(root, definitions, config) {
+	const locator = new Locator(root);
+	const map = (source, convert) => Object.fromEntries([...source].sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => [name, convert(value)]));
+	const roles = map(definitions.roles, (role) => ({
+		source: locator.call("role", role.origin, role.name),
+		label: role.options.label ?? humanize(role.name),
+		inboxes: (role.options.inboxes ?? []).map((inbox) => inbox.name),
+		resources: (role.options.resources ?? []).map((resource) => resource.name),
+		actions: (role.options.actions ?? []).map((action) => action.id),
+		pages: (role.options.pages ?? []).map((page) => page.name),
+		flags: (role.options.flags ?? []).map((flag) => flag.name),
+		reveal: role.options.reveal ?? false,
+		status: role.options.status ?? false
+	}));
+	const manifest = {
+		project: config.options.project,
+		environments: config.options.environments,
+		sync: config.options.sync,
+		delivery: config.options.delivery,
+		resources: map(definitions.resources, (resource) => resourceDef(locator, resource)),
+		actions: map(definitions.actions, (action) => actionDef(locator.call("action", action.origin, action.name), action.name, action)),
+		inboxes: map(definitions.inboxes, (inbox) => inboxDef(locator, inbox)),
+		views: map(definitions.views, (view) => viewDef(locator, view)),
+		pages: map(definitions.pages, (page) => pageDef(locator, page)),
+		flags: map(definitions.flags, (flag) => flagDef(locator, flag)),
+		roles,
+		spaces: [...definitions.spaces.values()].sort(byDefinition).map((space) => spaceDef(locator, space)),
+		notify: map(definitions.notify, (rule) => notifyDef(locator, rule)),
+		status: definitions.status && statusDef(locator, definitions.status, config)
+	};
+	return {
+		...manifest,
+		version: versionOf(manifest)
+	};
+}
+function unsourced(definitions) {
+	return Object.fromEntries(Object.entries(definitions).map(([name, { source: _, ...rest }]) => [name, rest]));
+}
+function versionOf(manifest) {
+	const content = {
+		...manifest,
+		resources: Object.fromEntries(Object.entries(manifest.resources).map(([name, { source: _, actions, ...rest }]) => [name, {
+			...rest,
+			actions: unsourced(actions)
+		}])),
+		actions: unsourced(manifest.actions),
+		inboxes: unsourced(manifest.inboxes),
+		views: unsourced(manifest.views),
+		pages: unsourced(manifest.pages),
+		flags: unsourced(manifest.flags),
+		roles: unsourced(manifest.roles),
+		spaces: manifest.spaces.map(({ source: _, ...rest }) => rest),
+		notify: unsourced(manifest.notify),
+		status: manifest.status && {
+			...manifest.status,
+			source: void 0
+		}
+	};
+	return createHash("sha256").update(stableJson(content)).digest("hex").slice(0, 12);
+}
+//#endregion
+//#region src/build/codegen.ts
+const OUT_DIR = ".pult";
+function projectModule(manifest, files) {
+	const component = Object.keys(manifest.status?.components ?? {}).map((name) => JSON.stringify(name)).join(" | ") || "never";
+	const entries = files.map((file) => `    ${JSON.stringify(file)}: () => import(${JSON.stringify(`../${file}`)}),`);
+	return [
+		"// Generated by `pult build`. Commit this file; don't edit it.",
+		"import type { Manifest, Project } from \"@lantharos/pult\"",
+		"import manifest from \"./manifest.json\" with { type: \"json\" }",
+		"",
+		`const project: Project<${component}> = {`,
+		`  manifest: manifest as Manifest<${component}>,`,
+		"  modules: {",
+		...entries,
+		"  },",
+		"}",
+		"",
+		"export default project",
+		""
+	].join("\n");
+}
+async function readManifest(root) {
+	try {
+		return JSON.parse(await readFile(join(root, OUT_DIR, "manifest.json"), "utf8"));
+	} catch {
+		return null;
+	}
+}
+async function writeOutput(root, manifest, files) {
+	const dir = join(root, OUT_DIR);
+	await mkdir(dir, { recursive: true });
+	await writeFile(join(dir, "manifest.json"), `${JSON.stringify(manifest, null, 2)}\n`);
+	await writeFile(join(dir, "index.ts"), projectModule(manifest, files));
+}
+//#endregion
+//#region src/build/index.ts
+async function build(root, importer) {
+	const project = await loadProject(root, importer);
+	const definitions = collect(project.modules);
+	const manifest = assemble(root, definitions, project.config);
+	const problems = [...check(manifest, project.impurities), ...await checkDefaults(definitions, manifest)];
+	return {
+		manifest,
+		files: project.files,
+		problems
+	};
+}
+async function checkDefaults(definitions, manifest) {
+	const problems = [];
+	for (const [name, flag] of definitions.flags) {
+		if (!flag.options.value) continue;
+		await validate(flag.options.value, flag.options.default).catch((error) => problems.push({
+			source: manifest.flags[name].source,
+			message: `flag ${name} defaults to an invalid value: ${error.message}`
+		}));
+	}
+	return problems;
+}
+//#endregion
+//#region src/cli/output.ts
+const dim = (text) => styleText("dim", text);
+const bold = (text) => styleText("bold", text);
+function fail(message) {
+	console.error(`${styleText("red", "✕")} ${message}`);
+	process.exit(1);
+}
+function done(message) {
+	console.log(`${styleText("green", "✓")} ${message}`);
+}
+function printProblems(problems) {
+	for (const { source, message } of problems) console.error(`${styleText("red", "✕")} ${dim(source)} ${message}`);
+}
+const MARK = {
+	add: ["+", "green"],
+	remove: ["-", "red"],
+	change: ["~", "yellow"],
+	grant: ["▲", ["bold", "magenta"]],
+	revoke: ["▼", "magenta"]
+};
+function printChanges(changes) {
+	if (!changes.length) return console.log(dim("  no changes"));
+	for (const change of changes) {
+		const [mark, style] = MARK[change.kind];
+		console.log(`  ${styleText(style, mark)} ${change.text}`);
+	}
+}
+//#endregion
+//#region src/cli/project.ts
+const RUNTIME_MODULES = [
+	"cloudflare:workers",
+	"cloudflare:email",
+	"cloudflare:sockets"
+];
+const STUB = fileURLToPath(new URL(import.meta.url.endsWith(".ts") ? "../build/stub.ts" : "./stub.mjs", import.meta.url));
+const importer = await (async () => {
+	if (typeof Bun !== "undefined") {
+		const exports = await import(STUB);
+		Bun.plugin({
+			name: "cloudflare-runtime",
+			setup(build) {
+				for (const name of RUNTIME_MODULES) build.module(name, () => ({
+					exports,
+					loader: "object"
+				}));
+			}
+		});
+		return (file) => import(file);
+	}
+	const { createJiti } = await import("jiti");
+	const alias = Object.fromEntries(RUNTIME_MODULES.map((name) => [name, STUB]));
+	const jiti = createJiti(import.meta.url, { alias });
+	return (file) => jiti.import(file);
+})();
+async function buildProject(root) {
+	try {
+		return await build(root, importer);
+	} catch (error) {
+		fail(error.message);
+	}
+}
+var Remote = class {
+	#transport;
+	constructor() {
+		const key = process.env.PULT_KEY;
+		if (!key) fail("Set PULT_KEY to the key of the environment you're targeting");
+		this.#transport = new Transport(key, process.env.PULT_URL ?? "https://app.pult.sh", fetch);
+	}
+	async #request(method, path, body) {
+		try {
+			return await this.#transport.request(method, path, body);
+		} catch (error) {
+			fail(error.message);
+		}
+	}
+	current() {
+		return this.#request("GET", "/v1/manifest");
+	}
+	deploy(manifest) {
+		return this.#request("POST", "/v1/manifest", manifest);
+	}
+};
+//#endregion
+//#region src/cli/commands/build.ts
+async function buildCommand(root) {
+	const { manifest, files, problems } = await buildProject(root);
+	if (problems.length) {
+		printProblems(problems);
+		fail(`${problems.length} problem${problems.length === 1 ? "" : "s"}, manifest not written`);
+	}
+	await writeOutput(root, manifest, files);
+	done(`manifest ${manifest.version} · ${files.length} files`);
+	return manifest;
+}
+//#endregion
+//#region src/cli/commands/check.ts
+async function checkCommand(root) {
+	const { manifest, problems } = await buildProject(root);
+	printProblems(problems);
+	if (problems.length) fail(`${problems.length} problem${problems.length === 1 ? "" : "s"}`);
+	if (stableJson(await readManifest(root)) !== stableJson(manifest)) fail("The committed manifest is out of date. Run `pult build`.");
+	done(`manifest ${manifest.version} is valid and up to date`);
+}
+//#endregion
+//#region src/cli/commands/deploy.ts
+async function deployCommand(root) {
+	const manifest = await buildCommand(root);
+	const remote = new Remote();
+	const current = await remote.current();
+	if (current.manifest?.version === manifest.version) return done(`${current.name} is already on ${manifest.version}`);
+	console.log(`${bold(current.name)} ${dim(`${current.manifest?.version ?? "empty"} → ${manifest.version}`)}`);
+	printChanges(diffManifests(current.manifest, manifest));
+	await remote.deploy(manifest);
+	done(`deployed ${manifest.version} to ${current.name}`);
+}
+//#endregion
+//#region src/cli/commands/dev.ts
+const IGNORED = /(^|[\\/])(node_modules|\.pult|\.git|dist|build)([\\/]|$)/;
+function devCommand(root) {
+	let running = false;
+	let queued = false;
+	const rebuild = () => {
+		if (running) {
+			queued = true;
+			return;
+		}
+		running = true;
+		spawn(process.execPath, [
+			...process.execArgv,
+			process.argv[1],
+			"build"
+		], {
+			cwd: root,
+			stdio: "inherit"
+		}).on("exit", () => {
+			running = false;
+			if (queued) {
+				queued = false;
+				rebuild();
+			}
+		});
+	};
+	let timer;
+	watch(root, { recursive: true }, (_, file) => {
+		if (!file || IGNORED.test(file) || !/\.(m?[jt]s)$/.test(file)) return;
+		clearTimeout(timer);
+		timer = setTimeout(rebuild, 80);
+	});
+	console.log(dim("watching for changes"));
+	rebuild();
+}
+//#endregion
+//#region src/cli/commands/diff.ts
+async function diffCommand(root) {
+	const { manifest, problems } = await buildProject(root);
+	if (problems.length) {
+		printProblems(problems);
+		fail("Fix the problems above first");
+	}
+	const current = await new Remote().current();
+	console.log(`${bold(current.name)} ${dim(`${current.manifest?.version ?? "empty"} → ${manifest.version}`)}`);
+	printChanges(diffManifests(current.manifest, manifest));
+}
+//#endregion
+//#region src/cli/commands/init.ts
+const WRANGLER_FILES = [
+	"wrangler.jsonc",
+	"wrangler.json",
+	"wrangler.toml"
+];
+const WEBHOOK_PATH = "/pult";
+function config(project, onWorkers) {
+	return `import { defineConfig } from "@lantharos/pult"
+
+export default defineConfig({
+  project: ${JSON.stringify(project)},
+  include: ["pult/**/*.ts"],${onWorkers ? `\n  delivery: { mode: "webhook", path: "${WEBHOOK_PATH}" },` : ""}
+})
+`;
+}
+const DEFINITIONS = `import { inbox, resource } from "@lantharos/pult"
+
+export const user = resource("user", {
+  get: (id) => ({ id, email: \`\${id}@example.com\` }),
+  title: (user) => user.email,
+})
+
+export const feedback = inbox("feedback", { resource: user })
+`;
+const SOCKET_CLIENT = `import { createPult } from "@lantharos/pult"
+import project from "../.pult"
+
+export const pult = createPult({ project })
+
+pult.listen()
+`;
+const WORKER_CLIENT = `import { env } from "cloudflare:workers"
+import { createPult } from "@lantharos/pult"
+import project from "../.pult"
+
+export const pult = createPult({ key: env.PULT_KEY, project })
+export const handlePult = pult.handler()
+`;
+async function projectName(root) {
+	return ((await readFile(join(root, "package.json"), "utf8").then((text) => JSON.parse(text)).catch(() => ({ name: void 0 }))).name ?? basename(root)).replace(/^@[^/]+\//, "").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "") || "app";
+}
+async function create(root, file, content) {
+	const path = join(root, file);
+	await mkdir(dirname(path), { recursive: true });
+	try {
+		await writeFile(path, content, { flag: "wx" });
+		done(`wrote ${file}`);
+	} catch (error) {
+		if (error.code !== "EEXIST") throw error;
+		console.log(dim(`  kept ${file}, it already exists`));
+	}
+}
+async function initCommand(root) {
+	const onWorkers = WRANGLER_FILES.some((file) => existsSync(join(root, file)));
+	await create(root, "pult.config.ts", config(await projectName(root), onWorkers));
+	await create(root, "pult/feedback.ts", DEFINITIONS);
+	await create(root, "src/pult.ts", onWorkers ? WORKER_CLIENT : SOCKET_CLIENT);
+	console.log(`\nNext, run ${bold("pult build")} and set PULT_KEY to your environment's key.`);
+	if (onWorkers) console.log(`Then hand Pult's requests to it in your fetch handler:\n\n  if (new URL(request.url).pathname === "${WEBHOOK_PATH}") return handlePult(request, ctx)`);
+}
+//#endregion
+//#region src/cli/index.ts
+const USAGE = `pult <command> [--cwd <path>]
+
+  init     set up Pult in this project
+  build    compile definitions into .pult/
+  check    find broken references and make sure .pult/ is current
+  diff     show what a deploy would change (uses PULT_KEY)
+  deploy   push the manifest to the environment behind PULT_KEY
+  dev      rebuild on every change
+
+  --cwd <path>    run in another project folder
+  -v, --version   print the version
+  -h, --help      show this help`;
+const { positionals, values } = parseArgs({
+	allowPositionals: true,
+	options: {
+		cwd: { type: "string" },
+		help: {
+			type: "boolean",
+			short: "h"
+		},
+		version: {
+			type: "boolean",
+			short: "v"
+		}
+	}
+});
+const root = resolve(values.cwd ?? ".");
+const commands = {
+	init: initCommand,
+	build: buildCommand,
+	check: checkCommand,
+	diff: diffCommand,
+	deploy: deployCommand,
+	dev: devCommand
+};
+const command = positionals[0];
+if (values.version) console.log(version);
+else if (values.help || !command) console.log(USAGE);
+else if (!commands[command]) fail(`Unknown command "${command}"\n\n${USAGE}`);
+else await commands[command](root);
+//#endregion
+export {};