@magland/mochi 0.3.1

package/dist/deploy-runner-cli.js

@@ -0,0 +1,592 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.deployFlyRunnerCmd = deployFlyRunnerCmd;
+exports.deployFlyRunnerShowCmd = deployFlyRunnerShowCmd;
+exports.deployFlyRunnerDestroyCmd = deployFlyRunnerDestroyCmd;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const cli_api_1 = require("./cli-api");
+const cli_api_2 = require("./cli-api");
+const wake_1 = require("./ci/wake");
+const deploy_cli_1 = require("./deploy-cli");
+const scan_1 = require("./scan");
+// `mochi deploy fly runner`: put a workflow runner on Fly.io, beside a
+// vault that is already there or anywhere else.
+//
+// A runner is not a second vault. It keeps nothing worth keeping, it serves no
+// requests, and it is worth money only while it is executing a job. So the
+// arrangement here is the opposite of the vault's: the machine stops as soon
+// as it has been idle for a few minutes, and the vault starts it again by
+// sending a request to it when a job is waiting. Between runs the app costs
+// nothing but its volume.
+//
+// The volume is mounted at /var/lib/docker, which is what makes stopping
+// affordable: a job image pulled once stays pulled, so a cold start is a boot
+// and not a download.
+const RUNNER_IMAGE_REPO = `${deploy_cli_1.IMAGE_REPO}-runner`;
+const VOLUME_NAME = 'docker';
+const INTERNAL_PORT = 3000;
+const HOST_SECRET = 'MOCHI_HOST';
+const TOKEN_SECRET = 'MOCHI_RUNNER_TOKEN';
+const WAKE_SECRET = 'MOCHI_WAKE_SECRET';
+// Bigger than the vault's defaults, because the work is the other way round: a
+// vault serves small requests from a disk, and a runner compiles things. The
+// volume holds job images rather than anything of the operator's, so it is
+// sized for a few of those and no more.
+const DEFAULTS = {
+    region: 'ewr',
+    volumeGb: 20,
+    cpuKind: 'shared',
+    cpus: 2,
+    memory: '2gb',
+    idle: '5m',
+};
+function parseArgs(args, usage) {
+    const out = {
+        app: null,
+        name: null,
+        allow: [],
+        labels: [],
+        region: null,
+        volumeGb: null,
+        vmSize: null,
+        memory: null,
+        idle: null,
+        image: null,
+        fromSource: false,
+        localBuild: false,
+        org: null,
+        host: null,
+        token: null,
+        yes: false,
+    };
+    const list = (v) => v.split(/[\s,]+/).filter((s) => s.length > 0);
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === '-h' || a === '--help')
+            usage();
+        else if (a === '--name')
+            out.name = args[++i];
+        else if (a === '--allow')
+            out.allow.push(...list(args[++i] ?? ''));
+        else if (a === '--labels' || a === '--label')
+            out.labels.push(...list(args[++i] ?? ''));
+        else if (a === '--region')
+            out.region = args[++i];
+        else if (a === '--volume') {
+            const gb = parseInt(args[++i], 10);
+            if (!Number.isInteger(gb) || gb < 1)
+                (0, deploy_cli_1.die)('--volume takes a size in whole gigabytes, e.g. --volume 20');
+            out.volumeGb = gb;
+        }
+        else if (a === '--vm-size')
+            out.vmSize = args[++i];
+        else if (a === '--vm-memory')
+            out.memory = args[++i];
+        else if (a === '--idle')
+            out.idle = args[++i];
+        else if (a === '--image')
+            out.image = args[++i];
+        else if (a === '--from-source')
+            out.fromSource = true;
+        else if (a === '--local-build')
+            out.localBuild = true;
+        else if (a === '--org')
+            out.org = args[++i];
+        else if (a === '--host')
+            out.host = args[++i];
+        else if (a === '--token')
+            out.token = args[++i];
+        else if (a === '-y' || a === '--yes')
+            out.yes = true;
+        else if (a.startsWith('-'))
+            (0, deploy_cli_1.die)(`Unknown option: ${a}`);
+        else if (!out.app)
+            out.app = a;
+        else
+            (0, deploy_cli_1.die)(`Unexpected argument: ${a}`);
+    }
+    return out;
+}
+/**
+ * Refuse the flags that shape a deployment on the commands that deploy nothing.
+ *
+ * `show` and `destroy` share the parser with the deploy, so accepting
+ * `--vm-size` here and ignoring it would look like it had been applied. Only
+ * the first one found is named, since fixing it means dropping it and running
+ * the command again either way.
+ */
+function rejectShapingFlags(a, usage, allowYes) {
+    const used = [
+        ['--name', a.name !== null],
+        ['--allow', a.allow.length > 0],
+        ['--labels', a.labels.length > 0],
+        ['--region', a.region !== null],
+        ['--volume', a.volumeGb !== null],
+        ['--vm-size', a.vmSize !== null],
+        ['--vm-memory', a.memory !== null],
+        ['--idle', a.idle !== null],
+        ['--image', a.image !== null],
+        ['--from-source', a.fromSource],
+        ['--local-build', a.localBuild],
+        ['--org', a.org !== null],
+        ['--yes', a.yes && !allowYes],
+    ];
+    const flag = used.find(([, given]) => given);
+    if (!flag)
+        return;
+    if (flag[0] === '--yes')
+        (0, deploy_cli_1.die)(`--yes confirms a destroy, and there is nothing here to confirm.\nUsage: ${usage}`);
+    (0, deploy_cli_1.die)(`${flag[0]} says how to deploy, and this command deploys nothing.\nUsage: ${usage}`);
+}
+/** Checked here rather than by the runner, since a bad value would only be found after a deploy. */
+function checkIdle(idle) {
+    if (!/^\d+\s*[smh]?$/i.test(idle.trim())) {
+        (0, deploy_cli_1.die)(`--idle takes a duration like 5m, 90s, or 1h, got: ${idle}`);
+    }
+    return idle.trim();
+}
+/** What Fly has now, so that a flag-less redeploy changes nothing and one flag changes one thing. */
+async function liveSettings(app) {
+    const out = {};
+    const vol = await (0, deploy_cli_1.namedVolume)(app, VOLUME_NAME);
+    if (vol) {
+        out.region = vol.region;
+        out.volumeGb = vol.size_gb;
+    }
+    const guest = (await (0, deploy_cli_1.machines)(app)).find((m) => m.config?.guest)?.config?.guest;
+    if (guest) {
+        if (guest.cpu_kind)
+            out.cpuKind = guest.cpu_kind;
+        if (guest.cpus)
+            out.cpus = guest.cpus;
+        if (guest.memory_mb)
+            out.memory = `${guest.memory_mb}mb`;
+    }
+    return out;
+}
+function resolveSettings(a, live) {
+    const base = { ...DEFAULTS, ...live };
+    const vm = a.vmSize ? (0, deploy_cli_1.parseVmSize)(a.vmSize) : null;
+    return {
+        region: a.region ?? base.region,
+        volumeGb: a.volumeGb ?? base.volumeGb,
+        cpuKind: vm?.cpuKind ?? base.cpuKind,
+        cpus: vm?.cpus ?? base.cpus,
+        memory: a.memory ? (0, deploy_cli_1.normalizeMemory)(a.memory) : base.memory,
+        idle: a.idle ? checkIdle(a.idle) : base.idle,
+    };
+}
+/**
+ * The generated fly.toml.
+ *
+ * Two settings carry the whole design. `auto_stop_machines = "off"` because
+ * Fly stops a machine that has had no inbound traffic, and a runner's traffic
+ * is all outbound: left on, it would stop a machine in the middle of a job.
+ * The runner stops itself instead, by exiting when idle, which a restart
+ * policy of "never" turns into a stopped machine rather than a restarted one.
+ * `auto_start_machines` is what the vault's wake request then acts on.
+ */
+function flyToml(app, s) {
+    return `# Generated by mochi deploy fly runner for '${app}'. Written to a temporary
+# directory for the length of one deploy; edit the deploy command, not this.
+app = "${app}"
+primary_region = "${s.region}"
+
+[mounts]
+  source = "${VOLUME_NAME}"
+  destination = "/var/lib/docker"
+
+[env]
+  MOCHI_IDLE = "${s.idle}"
+  MOCHI_WAKE_PORT = "${INTERNAL_PORT}"
+
+# The runner exits when it has been idle, and a machine whose process exits
+# stops. Restarting it here would defeat that entirely.
+[[restart]]
+  policy = "never"
+
+# Nothing serves anything here: the only request this app ever receives is the
+# vault's wake request, and the point of receiving it is that Fly starts the
+# machine in order to deliver it.
+[http_service]
+  internal_port = ${INTERNAL_PORT}
+  force_https = true
+  auto_stop_machines = "off"
+  auto_start_machines = true
+  min_machines_running = 0
+
+[[vm]]
+  cpu_kind = "${s.cpuKind}"
+  cpus = ${s.cpus}
+  memory = "${s.memory}"
+`;
+}
+function writeTempConfig(app, s) {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'mochi-runner-deploy-'));
+    const file = path.join(dir, 'fly.toml');
+    fs.writeFileSync(file, flyToml(app, s));
+    return file;
+}
+function wakeUrlFor(app) {
+    return `${(0, deploy_cli_1.appUrl)(app)}/wake`;
+}
+async function registeredRunners(target) {
+    const data = await (0, cli_api_1.api)(target, 'GET', '/api/runners');
+    return (data.runners ?? []) ?? [];
+}
+async function deployFlyRunnerCmd(args, usage) {
+    const a = parseArgs(args, usage);
+    if (!a.app) {
+        (0, deploy_cli_1.die)('Which app? Fly app names are globally unique, and this one is the address the vault\n' +
+            'will send its wake request to:\n\n' +
+            '  mochi deploy fly runner my-runner --allow "mycollection/*"\n');
+    }
+    const app = a.app;
+    if (!/^[a-z0-9][a-z0-9-]{0,62}$/.test(app)) {
+        (0, deploy_cli_1.die)(`Not a valid Fly app name: ${app}\nUse lowercase letters, digits, and dashes.`);
+    }
+    const name = a.name ?? app;
+    if (!(0, scan_1.isValidName)(name)) {
+        (0, deploy_cli_1.die)(`Not a usable runner name: ${name}\nUse letters, digits, dot, dash, underscore.`);
+    }
+    if (a.fromSource && a.image !== null) {
+        (0, deploy_cli_1.die)('--image names an image to pull and --from-source builds one instead. Pass one or the other.');
+    }
+    if (a.localBuild && !a.fromSource) {
+        (0, deploy_cli_1.die)('--local-build says how to build, and without --from-source there is nothing to build.');
+    }
+    const buildRoot = a.fromSource ? (0, deploy_cli_1.sourceRoot)() : null;
+    const image = buildRoot === null ? a.image ?? `${RUNNER_IMAGE_REPO}:${(0, deploy_cli_1.ownVersion)()}` : null;
+    // The vault first: a runner with no vault to serve is nothing, and finding
+    // out that the login is missing after creating a Fly app would be a poor
+    // trade. This is the same login every other admin command uses.
+    const target = await (0, cli_api_2.remoteTarget)(a);
+    const existingRunners = await registeredRunners(target);
+    const registered = existingRunners.find((r) => r.name === name) ?? null;
+    await (0, deploy_cli_1.requireFly)();
+    const appIsThere = await (0, deploy_cli_1.appExists)(app);
+    const secrets = appIsThere ? await (0, deploy_cli_1.secretNames)(app) : [];
+    if (!registered && a.allow.length === 0) {
+        (0, deploy_cli_1.die)(`No runner named '${name}' is registered with ${target.host}, so this deploy would\n` +
+            'register one, and a runner needs to be told which repositories it may take jobs\n' +
+            'for. It executes whatever their workflows contain, on the machine deployed here:\n\n' +
+            `  mochi deploy fly runner ${app} --allow 'mycollection/*'\n`);
+    }
+    // An --allow that repeats what the runner already serves is not a request to
+    // change anything, and refusing it would be perverse: a first deploy that
+    // registers the runner and then fails at the image leaves exactly that
+    // situation, and this command's own advice is to run it again unchanged.
+    // Only a different set is refused, because quietly ignoring that would leave
+    // an operator believing they had widened or narrowed what the runner serves.
+    const sameAllow = registered !== null &&
+        a.allow.length === registered.allow.length &&
+        [...a.allow].sort().join('') === [...registered.allow].sort().join('');
+    if (registered && a.allow.length > 0 && !sameAllow) {
+        (0, deploy_cli_1.die)(`Runner '${name}' is already registered, serving ${registered.allow.join(', ')}.\n` +
+            'This deploy does not change that. To change what it serves, remove and register it:\n\n' +
+            `  mochi runner remove ${name}\n` +
+            `  mochi deploy fly runner ${app} --allow '<globs>'\n`);
+    }
+    const live = appIsThere ? await liveSettings(app) : {};
+    const settings = resolveSettings(a, live);
+    if (appIsThere && live.region && a.region && a.region !== live.region) {
+        (0, deploy_cli_1.die)(`This runner's volume is in ${live.region}, and a volume cannot be moved to ${a.region}.\n` +
+            'Deploy a runner in another region as a second app, or destroy this one first.');
+    }
+    console.log(appIsThere ? `==> Updating '${app}' (${(0, deploy_cli_1.appUrl)(app)})` : `==> Creating '${app}' in ${settings.region}`);
+    if (!appIsThere) {
+        const created = await (0, deploy_cli_1.flyStream)(['apps', 'create', app, ...(a.org ? ['--org', a.org] : [])]);
+        if (created !== 0) {
+            (0, deploy_cli_1.die)(`\nCould not create the Fly app '${app}'.\n` +
+                'App names are globally unique, so a name in use by anyone stops this. Try another.');
+        }
+    }
+    const vol = await (0, deploy_cli_1.namedVolume)(app, VOLUME_NAME);
+    if (!vol) {
+        console.log(`==> Creating a ${settings.volumeGb}GB volume '${VOLUME_NAME}' in ${settings.region}`);
+        console.log('    It holds the images jobs run in, so that stopping when idle costs a boot');
+        console.log('    on the next job rather than a download.');
+        const code = await (0, deploy_cli_1.flyStream)([
+            'volumes',
+            'create',
+            VOLUME_NAME,
+            '-a',
+            app,
+            '--region',
+            settings.region,
+            '--size',
+            String(settings.volumeGb),
+            '--yes',
+        ]);
+        if (code !== 0)
+            (0, deploy_cli_1.die)('\nCould not create the volume.');
+    }
+    else if (settings.volumeGb > vol.size_gb) {
+        console.log(`==> Extending volume '${VOLUME_NAME}' from ${vol.size_gb}GB to ${settings.volumeGb}GB`);
+        const code = await (0, deploy_cli_1.flyStream)(['volumes', 'extend', vol.id, '-a', app, '--size', String(settings.volumeGb)]);
+        if (code !== 0)
+            (0, deploy_cli_1.die)('\nCould not extend the volume.');
+    }
+    else if (a.volumeGb !== null && a.volumeGb < vol.size_gb) {
+        (0, deploy_cli_1.die)(`The volume is ${vol.size_gb}GB and Fly volumes cannot be shrunk, so --volume ${a.volumeGb} cannot be applied.\n` +
+            'Leave the flag off to keep the size it has.');
+    }
+    // The token this machine will hold. A registration issues one; an existing
+    // runner whose token is not already a secret on this app needs a new one,
+    // because the old one is unrecoverable by design and there is no way to put
+    // it back. Rotating it stops any other machine running as this runner,
+    // which for a runner named after this app is the intended outcome.
+    const wake = { url: wakeUrlFor(app), secret: (0, wake_1.newWakeSecret)() };
+    let runnerToken = null;
+    if (!registered) {
+        console.log(`==> Registering runner '${name}' with ${target.host}`);
+        const data = await (0, cli_api_1.api)(target, 'POST', '/api/runners', {
+            name,
+            labels: a.labels.length ? a.labels : ['ubuntu-latest'],
+            allow: a.allow,
+            wakeUrl: wake.url,
+            wakeSecret: wake.secret,
+        });
+        runnerToken = data.token;
+    }
+    else if (!secrets.includes(TOKEN_SECRET)) {
+        console.log(`==> Issuing a token for the registered runner '${name}'`);
+        console.log('    Its previous token cannot be read back from anywhere, so this deploy gives it');
+        console.log('    a new one. Any other machine running as this runner will stop being able to.');
+        const data = await (0, cli_api_1.api)(target, 'POST', `/api/runners/${encodeURIComponent(name)}/token`, {});
+        runnerToken = data.token;
+    }
+    // The wake address is rewritten on every deploy, not only on the first. The
+    // secret is this run's, and the app it points at is this app; a redeploy
+    // that left an older secret in place would leave the vault sending one the
+    // machine has never been given.
+    console.log(`==> Pointing the vault's wake request at ${wake.url}`);
+    await (0, cli_api_1.api)(target, 'PUT', `/api/runners/${encodeURIComponent(name)}/wake`, {
+        wakeUrl: wake.url,
+        wakeSecret: wake.secret,
+    });
+    // Staged rather than set, so that no machine restarts before the deploy
+    // below, and over stdin so that no secret appears in this machine's `ps`.
+    const staged = [`${HOST_SECRET}=${target.host}`, `${WAKE_SECRET}=${wake.secret}`];
+    if (runnerToken)
+        staged.push(`${TOKEN_SECRET}=${runnerToken}`);
+    console.log('==> Setting the vault URL, the runner token, and the wake secret as Fly secrets');
+    const set = await (0, deploy_cli_1.fly)(['secrets', 'import', '-a', app, '--stage'], staged.join('\n') + '\n');
+    if (set.code !== 0)
+        (0, deploy_cli_1.die)(`Could not set the secrets:\n${set.stderr.trim() || set.stdout.trim()}`);
+    const config = writeTempConfig(app, settings);
+    if (buildRoot !== null) {
+        console.log(`==> Building ${buildRoot} ${a.localBuild ? 'with the local Docker' : "on Fly's builder"}`);
+    }
+    else {
+        console.log(`==> Deploying ${image}`);
+    }
+    const code = await (0, deploy_cli_1.flyStream)([
+        'deploy',
+        '--app',
+        app,
+        '--config',
+        config,
+        ...(buildRoot !== null
+            ? ['--dockerfile', path.join(buildRoot, 'Dockerfile.runner'), ...(a.localBuild ? ['--local-only'] : [])]
+            : ['--image', image]),
+        '--ha=false',
+        '--yes',
+    ], buildRoot ?? undefined);
+    fs.rmSync(path.dirname(config), { recursive: true, force: true });
+    if (code !== 0) {
+        console.error('');
+        console.error('The deploy failed. The app, the volume, and the registration survive, so fix the');
+        console.error('cause and run the same command again.');
+        if (buildRoot === null && a.image === null) {
+            // Named as the likely cause rather than as one possibility among many,
+            // because it is the one every early deploy hits: the runner image is
+            // published per release like the vault's, so a version of the CLI newer
+            // than the newest release has no image to pull. Fly reports a package
+            // that is absent, and one that is private, with the same message about
+            // authentication, and a package newly published to GHCR is private
+            // until someone says otherwise.
+            console.error('');
+            console.error(`If Fly could not fetch ${image}:`);
+            console.error('');
+            console.error('  - It may not be published. The runner image is built per release, so a CLI');
+            console.error('    newer than the newest release asks for a tag that does not exist yet.');
+            console.error('  - It may be private. A package newly published to GHCR is private until it');
+            console.error('    is made public, and Fly reports that as an authentication error too.');
+            console.error('');
+            console.error('Either way, this deploys the checkout you are running instead:');
+            console.error('');
+            console.error(`  mochi deploy fly runner ${app} --from-source`);
+            console.error('');
+            console.error('or --image <ref> deploys some other tag.');
+        }
+        process.exit(1);
+    }
+    // A machine is started by the deploy and will stop itself once it has been
+    // idle for the configured time. Saying so is worth a line, because a
+    // `deploy fly` that ends with a stopped machine looks like a failure to
+    // anyone who has deployed a vault before.
+    console.log('');
+    console.log(`==> Deployed: ${(0, deploy_cli_1.appUrl)(app)}`);
+    console.log('');
+    // Laid out as facts rather than as a sentence broken over three lines: the
+    // globs and the labels are lists of unknown length, and wrapping around them
+    // put a line break in the middle of a clause.
+    const servedLabels = registered?.labels ?? (a.labels.length ? a.labels : ['ubuntu-latest']);
+    console.log(`  runner   ${name}, registered with ${target.host}`);
+    console.log(`  serving  ${(registered?.allow ?? a.allow).join(', ')}`);
+    console.log(`  labels   ${servedLabels.join(', ')}, matched against a job's runs-on`);
+    console.log('');
+    console.log(`It stops after ${settings.idle} with no job, and the vault starts it again by`);
+    console.log('requesting its wake address when a job is waiting. So a machine in the stopped');
+    console.log('state is this working, not this broken; the first job after a stop waits about');
+    console.log('half a minute for the boot.');
+    console.log('');
+    console.log('  mochi runner list');
+    console.log(`  mochi runner wake ${name}      # start it now, and time how long that takes`);
+    console.log(`  fly logs -a ${app}`);
+    console.log('');
+    console.log(`  mochi deploy fly runner ${app} --vm-size shared-cpu-4x --idle 15m`);
+}
+async function deployFlyRunnerShowCmd(args, usage) {
+    const a = parseArgs(args, usage);
+    if (!a.app)
+        (0, deploy_cli_1.die)('Which app? Usage: mochi deploy fly runner show <app>');
+    rejectShapingFlags(a, 'mochi deploy fly runner show <app>', false);
+    const app = a.app;
+    await (0, deploy_cli_1.requireFly)();
+    if (!(await (0, deploy_cli_1.appExists)(app))) {
+        (0, deploy_cli_1.die)(`No Fly app named '${app}' that you can see. Check the name, or: fly apps list`);
+    }
+    const vol = await (0, deploy_cli_1.namedVolume)(app, VOLUME_NAME);
+    const ms = await (0, deploy_cli_1.machines)(app);
+    const secrets = await (0, deploy_cli_1.secretNames)(app);
+    console.log(`${app}  ${(0, deploy_cli_1.appUrl)(app)}`);
+    console.log('');
+    if (ms.length === 0) {
+        console.log('  machines  none');
+    }
+    else {
+        for (const m of ms) {
+            const g = m.config?.guest;
+            const shape = g ? `${g.cpu_kind}-cpu-${g.cpus}x, ${g.memory_mb}mb` : 'unknown shape';
+            // A stopped runner is the normal resting state, so the state is
+            // reported with what it means rather than on its own.
+            const meaning = m.state === 'stopped' ? ' (idle; the vault starts it when a job is waiting)' : '';
+            console.log(`  machine   ${m.id}  ${m.state ?? '?'}${meaning}  ${m.region ?? '?'}  ${shape}`);
+            console.log(`  image     ${m.config?.image ?? 'unknown'}`);
+        }
+    }
+    console.log(vol ? `  volume    ${vol.size_gb}GB in ${vol.region}, holding job images` : '  volume    none');
+    console.log(`  vault     ${secrets.includes(HOST_SECRET) ? 'configured as a Fly secret' : 'not configured'}`);
+    console.log(`  token     ${secrets.includes(TOKEN_SECRET) ? 'set' : 'not set, so this runner cannot poll'}`);
+    console.log(`  wake      ${secrets.includes(WAKE_SECRET) ? wakeUrlFor(app) : 'no secret set, so wake requests are refused'}`);
+    // Whether the vault agrees, which is the half Fly cannot answer: an app that
+    // is perfectly healthy and a registration that was removed look identical
+    // from here.
+    try {
+        const target = await (0, cli_api_2.remoteTarget)(a);
+        const runners = await registeredRunners(target);
+        const mine = runners.filter((r) => r.wakeUrl === wakeUrlFor(app));
+        if (mine.length === 0) {
+            console.log(`  runner    no runner on ${target.host} is woken at this app`);
+        }
+        else {
+            for (const r of mine) {
+                console.log(`  runner    ${r.name} on ${target.host}, serving ${r.allow.join(', ')}`);
+            }
+        }
+    }
+    catch (e) {
+        console.log(`  runner    could not ask the vault: ${e instanceof Error ? e.message : e}`);
+    }
+    console.log('');
+    console.log(`  fly logs -a ${app}`);
+}
+async function deployFlyRunnerDestroyCmd(args, usage) {
+    const a = parseArgs(args, usage);
+    if (!a.app)
+        (0, deploy_cli_1.die)('Which app? Usage: mochi deploy fly runner destroy <app> [--yes]');
+    rejectShapingFlags(a, 'mochi deploy fly runner destroy <app> [--yes]', true);
+    const app = a.app;
+    await (0, deploy_cli_1.requireFly)();
+    if (!(await (0, deploy_cli_1.appExists)(app))) {
+        (0, deploy_cli_1.die)(`No Fly app named '${app}' that you can see. Check the name, or: fly apps list`);
+    }
+    // Which registration this app was serving, asked before the app is gone,
+    // since the wake address is the only thing tying the two together.
+    let orphan = null;
+    let target = null;
+    try {
+        target = await (0, cli_api_2.remoteTarget)(a);
+        const runners = await registeredRunners(target);
+        orphan = runners.find((r) => r.wakeUrl === wakeUrlFor(app))?.name ?? null;
+    }
+    catch {
+        // A destroy should not require a working login; it only makes the tidying
+        // below unavailable.
+    }
+    if (!a.yes) {
+        console.log(`This destroys the Fly app '${app}' and its volume of cached job images.`);
+        console.log('Nothing of yours is on it: a runner keeps no state that matters between jobs.');
+        if (orphan)
+            console.log(`The runner '${orphan}' stays registered with the vault, and this offers to remove it.`);
+        console.log('');
+        const answer = await (0, deploy_cli_1.promptLine)('Type the app name to confirm: ');
+        if (answer !== app)
+            (0, deploy_cli_1.die)('Not destroyed.');
+    }
+    const code = await (0, deploy_cli_1.flyStream)(['apps', 'destroy', app, '--yes']);
+    if (code !== 0)
+        (0, deploy_cli_1.die)('\nCould not destroy the app.');
+    if (orphan && target) {
+        // A registration whose machine is gone is worse than useless: the vault
+        // goes on trying to wake an app that no longer exists, and a queued job
+        // waits for a runner that will never poll.
+        await (0, cli_api_1.api)(target, 'DELETE', `/api/runners/${encodeURIComponent(orphan)}`);
+        console.log(`Removed the runner registration '${orphan}' from ${target.host}.`);
+    }
+    else if (orphan === null) {
+        console.log('');
+        console.log('No runner registration was found pointing at this app. If one is left behind,');
+        console.log('it will keep a queued job waiting for a runner that cannot start:');
+        console.log('');
+        console.log('  mochi runner list');
+        console.log('  mochi runner remove <name>');
+    }
+}