@matthesketh/fleet 1.0.0

package/dist/core/docker.js

@@ -0,0 +1,72 @@
+import { readFileSync, existsSync } from 'node:fs';
+import { exec } from './exec.js';
+const SECRETS_BASE = '/run/fleet-secrets';
+function loadEnvFile(path) {
+    if (!existsSync(path))
+        return {};
+    const vars = {};
+    for (const line of readFileSync(path, 'utf-8').split('\n')) {
+        const trimmed = line.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        const eq = trimmed.indexOf('=');
+        if (eq < 1)
+            continue;
+        const key = trimmed.slice(0, eq);
+        let val = trimmed.slice(eq + 1);
+        // Strip surrounding quotes
+        if ((val.startsWith('"') && val.endsWith('"')) || (val.startsWith("'") && val.endsWith("'"))) {
+            val = val.slice(1, -1);
+        }
+        vars[key] = val;
+    }
+    return vars;
+}
+export function listContainers() {
+    const result = exec('docker ps --format "{{.Names}}\\t{{.Status}}\\t{{.Ports}}\\t{{.Image}}"', { timeout: 10_000 });
+    if (!result.ok || !result.stdout)
+        return [];
+    return result.stdout.split('\n').map(line => {
+        const [name, rawStatus, ports, image] = line.split('\t');
+        const health = rawStatus.includes('(healthy)') ? 'healthy'
+            : rawStatus.includes('(unhealthy)') ? 'unhealthy'
+                : rawStatus.includes('(health:') ? 'starting'
+                    : 'none';
+        const uptime = rawStatus.replace(/\s*\(.*?\)\s*/g, '').replace(/^Up\s+/, '');
+        return { name, status: rawStatus, health, ports: ports ?? '', image: image ?? '', uptime };
+    });
+}
+export function getContainersByCompose(composePath, composeFile) {
+    const fileFlag = composeFile ? `-f ${composeFile}` : '';
+    const result = exec(`docker compose ${fileFlag} ps --format "{{.Names}}"`, { cwd: composePath, timeout: 10_000 });
+    if (!result.ok || !result.stdout)
+        return [];
+    return result.stdout.split('\n').filter(Boolean);
+}
+export function getContainerLogs(container, lines = 100) {
+    const result = exec(`docker logs --tail ${lines} ${container} 2>&1`, { timeout: 15_000 });
+    return result.ok ? result.stdout : result.stderr || 'No logs available';
+}
+export function composeBuild(composePath, composeFile, appName) {
+    const fileFlag = composeFile ? `-f ${composeFile}` : '';
+    const env = appName ? loadEnvFile(`${SECRETS_BASE}/${appName}/.env`) : {};
+    const result = exec(`docker compose ${fileFlag} build`, { cwd: composePath, timeout: 300_000, env: Object.keys(env).length > 0 ? env : undefined });
+    return result.ok;
+}
+export function composeUp(composePath, composeFile) {
+    const fileFlag = composeFile ? `-f ${composeFile}` : '';
+    const result = exec(`docker compose ${fileFlag} up -d --force-recreate`, { cwd: composePath, timeout: 120_000 });
+    return result.ok;
+}
+export function composeDown(composePath, composeFile) {
+    const fileFlag = composeFile ? `-f ${composeFile}` : '';
+    const result = exec(`docker compose ${fileFlag} down`, { cwd: composePath, timeout: 60_000 });
+    return result.ok;
+}
+export function inspectContainer(name) {
+    const result = exec(`docker inspect ${name}`, { timeout: 10_000 });
+    if (!result.ok)
+        return null;
+    const parsed = JSON.parse(result.stdout);
+    return Array.isArray(parsed) ? parsed[0] : parsed;
+}

package/dist/core/errors.d.ts

@@ -0,0 +1,20 @@
+export declare class FleetError extends Error {
+    exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export declare class AppNotFoundError extends FleetError {
+    constructor(app: string);
+}
+export declare class ServiceError extends FleetError {
+    service: string;
+    constructor(message: string, service: string);
+}
+export declare class SecretsError extends FleetError {
+    constructor(message: string);
+}
+export declare class VaultNotInitializedError extends SecretsError {
+    constructor();
+}
+export declare class GitError extends FleetError {
+    constructor(message: string);
+}

package/dist/core/errors.js

@@ -0,0 +1,40 @@
+export class FleetError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'FleetError';
+    }
+}
+export class AppNotFoundError extends FleetError {
+    constructor(app) {
+        super(`App not found: ${app}`);
+        this.name = 'AppNotFoundError';
+    }
+}
+export class ServiceError extends FleetError {
+    service;
+    constructor(message, service) {
+        super(message);
+        this.service = service;
+        this.name = 'ServiceError';
+    }
+}
+export class SecretsError extends FleetError {
+    constructor(message) {
+        super(message);
+        this.name = 'SecretsError';
+    }
+}
+export class VaultNotInitializedError extends SecretsError {
+    constructor() {
+        super('Vault not initialized. Run: fleet secrets init');
+        this.name = 'VaultNotInitializedError';
+    }
+}
+export class GitError extends FleetError {
+    constructor(message) {
+        super(message);
+        this.name = 'GitError';
+    }
+}

package/dist/core/exec.d.ts

@@ -0,0 +1,14 @@
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+    ok: boolean;
+}
+export declare function exec(cmd: string, opts?: {
+    timeout?: number;
+    cwd?: string;
+    env?: Record<string, string>;
+}): ExecResult;
+export declare function execLive(cmd: string, args: string[], opts?: {
+    cwd?: string;
+}): number;

package/dist/core/exec.js

@@ -0,0 +1,30 @@
+import { execSync, spawnSync } from 'node:child_process';
+export function exec(cmd, opts = {}) {
+    try {
+        const stdout = execSync(cmd, {
+            timeout: opts.timeout ?? 30_000,
+            cwd: opts.cwd,
+            env: opts.env ? { ...process.env, ...opts.env } : undefined,
+            encoding: 'utf-8',
+            stdio: ['pipe', 'pipe', 'pipe'],
+        });
+        return { stdout: stdout.trim(), stderr: '', exitCode: 0, ok: true };
+    }
+    catch (err) {
+        const e = err;
+        return {
+            stdout: (e.stdout ?? '').toString().trim(),
+            stderr: (e.stderr ?? '').toString().trim(),
+            exitCode: e.status ?? 1,
+            ok: false,
+        };
+    }
+}
+export function execLive(cmd, args, opts = {}) {
+    const result = spawnSync(cmd, args, {
+        cwd: opts.cwd,
+        stdio: 'inherit',
+        encoding: 'utf-8',
+    });
+    return result.status ?? 1;
+}

package/dist/core/git-onboard.d.ts

@@ -0,0 +1,11 @@
+import { GitStatus } from './git.js';
+export type OnboardScenario = 'fresh' | 'migrate' | 'no-remote' | 'resume';
+export interface OnboardResult {
+    scenario: OnboardScenario;
+    steps: string[];
+    repoUrl: string;
+    branches: string[];
+}
+export declare function detectScenario(status: GitStatus): OnboardScenario;
+export declare function describeOnboardPlan(scenario: OnboardScenario, repoName: string, _status: GitStatus): string[];
+export declare function executeOnboard(scenario: OnboardScenario, cwd: string, repoName: string, appName: string, status: GitStatus): OnboardResult;

package/dist/core/git-onboard.js

@@ -0,0 +1,149 @@
+import { ensureGitignore, gitInit, gitAdd, gitCommit, gitCheckout, gitPush, gitPushAll, gitAddRemote, gitSetRemoteUrl, branchExists, hasCommits, } from './git.js';
+import * as github from './github.js';
+import { load, findApp, save } from './registry.js';
+export function detectScenario(status) {
+    if (!status.initialised)
+        return 'fresh';
+    if (status.remoteUrl && status.remoteUrl.includes('heskethwebdesign/'))
+        return 'resume';
+    if (status.remoteUrl && status.remoteUrl.includes('wrxck/'))
+        return 'migrate';
+    if (!status.remoteUrl)
+        return 'no-remote';
+    return 'fresh';
+}
+export function describeOnboardPlan(scenario, repoName, _status) {
+    const repoUrl = `git@github.com:heskethwebdesign/${repoName}.git`;
+    const steps = [];
+    switch (scenario) {
+        case 'fresh':
+            steps.push('generate .gitignore');
+            steps.push('git init -b main');
+            steps.push('git add . && git commit -m "initial commit"');
+            steps.push(`create private repo heskethwebdesign/${repoName}`);
+            steps.push(`add remote origin ${repoUrl}`);
+            steps.push('push main');
+            steps.push('create and push develop branch');
+            steps.push('protect main and develop branches');
+            steps.push('update fleet registry');
+            break;
+        case 'migrate':
+            steps.push('ensure .gitignore exists');
+            steps.push(`create private repo heskethwebdesign/${repoName}`);
+            steps.push(`git remote set-url origin ${repoUrl}`);
+            steps.push('git push --all origin');
+            steps.push('ensure develop branch exists');
+            steps.push('protect main and develop branches');
+            steps.push('update fleet registry');
+            break;
+        case 'no-remote':
+            steps.push('ensure .gitignore exists');
+            steps.push('commit any outstanding changes');
+            steps.push(`create private repo heskethwebdesign/${repoName}`);
+            steps.push(`add remote origin ${repoUrl}`);
+            steps.push('git push --all origin');
+            steps.push('ensure develop branch exists');
+            steps.push('protect main and develop branches');
+            steps.push('update fleet registry');
+            break;
+        case 'resume':
+            steps.push('ensure repo exists');
+            steps.push('commit any outstanding changes');
+            steps.push('push all branches');
+            steps.push('ensure develop branch exists');
+            steps.push('protect main and develop branches');
+            steps.push('update fleet registry');
+            break;
+    }
+    return steps;
+}
+function ensureDevelop(cwd, steps) {
+    if (!branchExists(cwd, 'develop')) {
+        gitCheckout(cwd, 'develop', true);
+        gitPush(cwd, 'develop', true);
+        steps.push('created and pushed develop branch');
+    }
+    else {
+        steps.push('develop branch already exists');
+    }
+}
+export function executeOnboard(scenario, cwd, repoName, appName, status) {
+    const repoUrl = github.getRepoUrl(repoName);
+    const steps = [];
+    steps.push(ensureGitignore(cwd));
+    switch (scenario) {
+        case 'fresh': {
+            gitInit(cwd);
+            steps.push('initialised git repo (main branch)');
+            gitAdd(cwd);
+            gitCommit(cwd, 'Initial commit');
+            steps.push('created initial commit');
+            github.createRepo(repoName);
+            steps.push(`created private repo heskethwebdesign/${repoName}`);
+            gitAddRemote(cwd, 'origin', repoUrl);
+            gitPush(cwd, 'main', true);
+            steps.push('pushed main to origin');
+            gitCheckout(cwd, 'develop', true);
+            gitPush(cwd, 'develop', true);
+            steps.push('created and pushed develop branch');
+            break;
+        }
+        case 'migrate': {
+            github.createRepo(repoName);
+            steps.push(`created private repo heskethwebdesign/${repoName}`);
+            gitSetRemoteUrl(cwd, repoUrl);
+            steps.push(`updated remote to ${repoUrl}`);
+            gitPushAll(cwd);
+            steps.push('pushed all branches to new remote');
+            ensureDevelop(cwd, steps);
+            break;
+        }
+        case 'no-remote': {
+            if (!status.clean) {
+                gitAdd(cwd);
+                gitCommit(cwd, 'Pre-onboard commit');
+                steps.push('committed outstanding changes');
+            }
+            if (!hasCommits(cwd)) {
+                gitAdd(cwd);
+                gitCommit(cwd, 'Initial commit');
+                steps.push('created initial commit');
+            }
+            github.createRepo(repoName);
+            steps.push(`created private repo heskethwebdesign/${repoName}`);
+            gitAddRemote(cwd, 'origin', repoUrl);
+            gitPushAll(cwd);
+            steps.push('added remote and pushed all branches');
+            ensureDevelop(cwd, steps);
+            break;
+        }
+        case 'resume': {
+            github.createRepo(repoName);
+            steps.push('ensured repo exists');
+            if (hasCommits(cwd)) {
+                gitPushAll(cwd);
+                steps.push('pushed existing commits');
+            }
+            ensureDevelop(cwd, steps);
+            break;
+        }
+    }
+    const mainProtected = github.protectBranch(repoName, 'main');
+    const devProtected = github.protectBranch(repoName, 'develop');
+    if (mainProtected && devProtected) {
+        steps.push('protected main and develop branches');
+    }
+    else {
+        steps.push('branch protection skipped (requires github pro for private repos)');
+    }
+    const reg = load();
+    const app = findApp(reg, appName);
+    if (app) {
+        app.gitRepo = `heskethwebdesign/${repoName}`;
+        app.gitRemoteUrl = repoUrl;
+        app.gitOnboardedAt = new Date().toISOString();
+        save(reg);
+        steps.push('updated fleet registry');
+    }
+    return { scenario, steps, repoUrl, branches: ['main', 'develop'] };
+}

package/dist/core/git.d.ts

@@ -0,0 +1,36 @@
+export interface GitStatus {
+    initialised: boolean;
+    branch: string;
+    branches: string[];
+    remoteName: string;
+    remoteUrl: string;
+    clean: boolean;
+    staged: number;
+    modified: number;
+    untracked: number;
+    ahead: number;
+    behind: number;
+}
+export interface GitLogEntry {
+    hash: string;
+    subject: string;
+    date: string;
+}
+export declare function isGitRepo(cwd: string): boolean;
+export declare function hasCommits(cwd: string): boolean;
+export declare function getGitStatus(cwd: string): GitStatus;
+export declare function getLog(cwd: string, count?: number): GitLogEntry[];
+export declare function hasGitignore(cwd: string): boolean;
+export declare function readGitignore(cwd: string): string;
+export declare function branchExists(cwd: string, branch: string): boolean;
+export declare function getProjectRoot(composePath: string): string;
+export declare function gitInit(cwd: string): void;
+export declare function gitAdd(cwd: string, paths?: string[]): void;
+export declare function gitCommit(cwd: string, message: string): void;
+export declare function gitCheckout(cwd: string, branch: string, create?: boolean): void;
+export declare function gitPush(cwd: string, branch: string, setUpstream?: boolean): void;
+export declare function gitPushAll(cwd: string): void;
+export declare function gitSetRemoteUrl(cwd: string, url: string): void;
+export declare function gitAddRemote(cwd: string, name: string, url: string): void;
+export declare function writeGitignore(cwd: string, content: string): void;
+export declare function ensureGitignore(cwd: string): string;

package/dist/core/git.js

@@ -0,0 +1,155 @@
+import { existsSync, writeFileSync, readFileSync } from 'node:fs';
+import { join, dirname, basename } from 'node:path';
+import { exec } from './exec.js';
+import { GitError } from './errors.js';
+import { detectProjectType, generateGitignore } from '../templates/gitignore.js';
+const SSH_AGENT_SOCK = '/tmp/fleet-ssh-agent.sock';
+if (existsSync(SSH_AGENT_SOCK)) {
+    process.env.SSH_AUTH_SOCK = SSH_AGENT_SOCK;
+}
+export function isGitRepo(cwd) {
+    return exec('git rev-parse --is-inside-work-tree', { cwd }).ok;
+}
+export function hasCommits(cwd) {
+    return exec('git rev-parse HEAD', { cwd }).ok;
+}
+export function getGitStatus(cwd) {
+    if (!isGitRepo(cwd)) {
+        return {
+            initialised: false, branch: '', branches: [], remoteName: '', remoteUrl: '',
+            clean: true, staged: 0, modified: 0, untracked: 0, ahead: 0, behind: 0,
+        };
+    }
+    const branch = exec('git rev-parse --abbrev-ref HEAD', { cwd }).stdout || '';
+    const branchResult = exec('git branch --list --no-color', { cwd });
+    const branches = branchResult.stdout
+        .split('\n')
+        .map(b => b.replace(/^\*?\s+/, '').trim())
+        .filter(Boolean);
+    const remoteName = exec('git remote', { cwd }).stdout.split('\n')[0] || '';
+    const remoteUrl = remoteName
+        ? exec(`git remote get-url ${remoteName}`, { cwd }).stdout
+        : '';
+    const porcelain = exec('git status --porcelain', { cwd }).stdout;
+    const lines = porcelain ? porcelain.split('\n') : [];
+    let staged = 0, modified = 0, untracked = 0;
+    for (const line of lines) {
+        const x = line[0], y = line[1];
+        if (x === '?' && y === '?')
+            untracked++;
+        else if (x !== ' ' && x !== '?')
+            staged++;
+        if (y !== ' ' && y !== '?')
+            modified++;
+    }
+    let ahead = 0, behind = 0;
+    if (remoteName && hasCommits(cwd)) {
+        const abResult = exec(`git rev-list --left-right --count HEAD...${remoteName}/${branch}`, { cwd });
+        if (abResult.ok) {
+            const parts = abResult.stdout.split(/\s+/);
+            ahead = parseInt(parts[0], 10) || 0;
+            behind = parseInt(parts[1], 10) || 0;
+        }
+    }
+    return {
+        initialised: true, branch, branches, remoteName, remoteUrl,
+        clean: lines.length === 0, staged, modified, untracked, ahead, behind,
+    };
+}
+export function getLog(cwd, count = 10) {
+    const result = exec(`git log --oneline --format="%H|%s|%ci" -${count}`, { cwd });
+    if (!result.ok)
+        return [];
+    return result.stdout.split('\n').filter(Boolean).map(line => {
+        const [hash, subject, ...dateParts] = line.split('|');
+        return { hash, subject, date: dateParts.join('|') };
+    });
+}
+export function hasGitignore(cwd) {
+    return existsSync(join(cwd, '.gitignore'));
+}
+export function readGitignore(cwd) {
+    const p = join(cwd, '.gitignore');
+    return existsSync(p) ? readFileSync(p, 'utf-8') : '';
+}
+export function branchExists(cwd, branch) {
+    return exec(`git show-ref --verify --quiet refs/heads/${branch}`, { cwd }).ok;
+}
+// walk up from composePath to find git root
+const SUBDIR_NAMES = new Set(['server', 'app', 'backend', 'frontend']);
+export function getProjectRoot(composePath) {
+    if (existsSync(join(composePath, '.git')))
+        return composePath;
+    let dir = composePath;
+    for (let i = 0; i < 5; i++) {
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        if (existsSync(join(parent, '.git')))
+            return parent;
+        dir = parent;
+    }
+    // if current dir is a known subdir name, go up
+    dir = composePath;
+    for (let i = 0; i < 3; i++) {
+        if (SUBDIR_NAMES.has(basename(dir))) {
+            dir = dirname(dir);
+        }
+        else {
+            break;
+        }
+    }
+    return dir;
+}
+export function gitInit(cwd) {
+    const r = exec('git init -b main', { cwd });
+    if (!r.ok)
+        throw new GitError(`git init failed: ${r.stderr}`);
+}
+export function gitAdd(cwd, paths = ['.']) {
+    const r = exec(`git add ${paths.join(' ')}`, { cwd });
+    if (!r.ok)
+        throw new GitError(`git add failed: ${r.stderr}`);
+}
+export function gitCommit(cwd, message) {
+    const r = exec(`git commit -m "${message.replace(/"/g, '\\"')}"`, { cwd });
+    if (!r.ok)
+        throw new GitError(`git commit failed: ${r.stderr}`);
+}
+export function gitCheckout(cwd, branch, create = false) {
+    const flag = create ? '-b' : '';
+    const r = exec(`git checkout ${flag} ${branch}`, { cwd });
+    if (!r.ok)
+        throw new GitError(`git checkout failed: ${r.stderr}`);
+}
+export function gitPush(cwd, branch, setUpstream = false) {
+    const flag = setUpstream ? '-u origin' : '';
+    const r = exec(`git push ${flag} ${branch}`, { cwd, timeout: 60_000 });
+    if (!r.ok)
+        throw new GitError(`git push failed: ${r.stderr}`);
+}
+export function gitPushAll(cwd) {
+    const r = exec('git push --all origin', { cwd, timeout: 60_000 });
+    if (!r.ok)
+        throw new GitError(`git push --all failed: ${r.stderr}`);
+}
+export function gitSetRemoteUrl(cwd, url) {
+    const r = exec(`git remote set-url origin ${url}`, { cwd });
+    if (!r.ok)
+        throw new GitError(`git remote set-url failed: ${r.stderr}`);
+}
+export function gitAddRemote(cwd, name, url) {
+    const r = exec(`git remote add ${name} ${url}`, { cwd });
+    if (!r.ok)
+        throw new GitError(`git remote add failed: ${r.stderr}`);
+}
+export function writeGitignore(cwd, content) {
+    writeFileSync(join(cwd, '.gitignore'), content);
+}
+export function ensureGitignore(cwd) {
+    if (hasGitignore(cwd))
+        return '.gitignore already exists';
+    const type = detectProjectType(cwd);
+    writeGitignore(cwd, generateGitignore(type));
+    return `generated .gitignore (${type})`;
+}

package/dist/core/github.d.ts

@@ -0,0 +1,22 @@
+export declare const GITHUB_ORG = "heskethwebdesign";
+export interface PullRequest {
+    number: number;
+    title: string;
+    url: string;
+    head: string;
+    base: string;
+    state: string;
+}
+export declare function isGhAuthenticated(): boolean;
+export declare function requireGhAuth(): void;
+export declare function repoExists(name: string): boolean;
+export declare function createRepo(name: string): void;
+export declare function getRepoUrl(name: string): string;
+export declare function createPullRequest(repo: string, opts: {
+    title: string;
+    body?: string;
+    head: string;
+    base: string;
+}): PullRequest;
+export declare function listPullRequests(repo: string, state?: 'open' | 'closed' | 'all'): PullRequest[];
+export declare function protectBranch(repo: string, branch: string): boolean;

package/dist/core/github.js

@@ -0,0 +1,92 @@
+import { writeFileSync, unlinkSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { exec } from './exec.js';
+import { GitError } from './errors.js';
+export const GITHUB_ORG = 'heskethwebdesign';
+export function isGhAuthenticated() {
+    return exec('gh auth status', { timeout: 10_000 }).ok;
+}
+export function requireGhAuth() {
+    if (!isGhAuthenticated()) {
+        throw new GitError('gh cli not authenticated. Run: gh auth login');
+    }
+}
+export function repoExists(name) {
+    return exec(`gh repo view ${GITHUB_ORG}/${name} --json name`, { timeout: 15_000 }).ok;
+}
+export function createRepo(name) {
+    requireGhAuth();
+    if (repoExists(name))
+        return;
+    const r = exec(`gh repo create ${GITHUB_ORG}/${name} --private`, { timeout: 30_000 });
+    if (!r.ok)
+        throw new GitError(`failed to create repo: ${r.stderr}`);
+}
+export function getRepoUrl(name) {
+    return `git@github.com:${GITHUB_ORG}/${name}.git`;
+}
+export function createPullRequest(repo, opts) {
+    requireGhAuth();
+    const bodyFlag = opts.body ? `--body "${opts.body.replace(/"/g, '\\"')}"` : '--body ""';
+    const r = exec(`gh pr create --repo ${GITHUB_ORG}/${repo} --title "${opts.title.replace(/"/g, '\\"')}" ${bodyFlag} --head ${opts.head} --base ${opts.base} --json number,title,url,headRefName,baseRefName,state`, { timeout: 30_000 });
+    if (!r.ok)
+        throw new GitError(`failed to create PR: ${r.stderr}`);
+    try {
+        const data = JSON.parse(r.stdout);
+        return {
+            number: data.number,
+            title: data.title,
+            url: data.url,
+            head: data.headRefName,
+            base: data.baseRefName,
+            state: data.state,
+        };
+    }
+    catch {
+        // gh pr create outputs the url on success without --json working on create
+        const url = r.stdout.trim().split('\n').pop() || '';
+        return { number: 0, title: opts.title, url, head: opts.head, base: opts.base, state: 'open' };
+    }
+}
+export function listPullRequests(repo, state = 'open') {
+    requireGhAuth();
+    const r = exec(`gh pr list --repo ${GITHUB_ORG}/${repo} --state ${state} --json number,title,url,headRefName,baseRefName,state`, { timeout: 15_000 });
+    if (!r.ok)
+        return [];
+    try {
+        const items = JSON.parse(r.stdout);
+        return items.map(d => ({
+            number: d.number, title: d.title, url: d.url,
+            head: d.headRefName, base: d.baseRefName, state: d.state,
+        }));
+    }
+    catch {
+        return [];
+    }
+}
+export function protectBranch(repo, branch) {
+    requireGhAuth();
+    const protection = JSON.stringify({
+        required_pull_request_reviews: {
+            dismiss_stale_reviews: true,
+            require_code_owner_reviews: false,
+            required_approving_review_count: 1,
+        },
+        enforce_admins: false,
+        required_status_checks: null,
+        restrictions: null,
+    });
+    const tmpFile = join(tmpdir(), `fleet-protect-${repo}-${branch}.json`);
+    writeFileSync(tmpFile, protection);
+    try {
+        const r = exec(`gh api -X PUT repos/${GITHUB_ORG}/${repo}/branches/${branch}/protection --input ${tmpFile}`, { timeout: 15_000 });
+        return r.ok;
+    }
+    finally {
+        try {
+            unlinkSync(tmpFile);
+        }
+        catch { }
+    }
+}

package/dist/core/health.d.ts

@@ -0,0 +1,29 @@
+import { type ServiceStatus } from './systemd.js';
+import { type ContainerInfo } from './docker.js';
+import type { AppEntry } from './registry.js';
+export interface HealthResult {
+    app: string;
+    systemd: {
+        ok: boolean;
+        state: string;
+    };
+    containers: ContainerHealth[];
+    http: {
+        ok: boolean;
+        status: number | null;
+        error: string | null;
+    } | null;
+    overall: 'healthy' | 'degraded' | 'down';
+}
+export interface ContainerHealth {
+    name: string;
+    running: boolean;
+    health: string;
+}
+export interface PrefetchedData {
+    containers: ContainerInfo[];
+    serviceStatus: ServiceStatus | null;
+}
+export declare function checkHealth(app: AppEntry, prefetched?: PrefetchedData): HealthResult;
+export declare function checkHttp(port: number, healthPath?: string): HealthResult['http'];
+export declare function checkAllHealth(apps: AppEntry[]): HealthResult[];