@mp-lb/arcnet 0.0.0-stage → 0.1.0

package/dist/parseSelection.js

@@ -0,0 +1,13 @@
+import { serviceDeploySchema, } from "@mp-lb/zapper/dist/arc/schemas.js";
+export const parseSelection = (input) => {
+    if (!input ||
+        typeof input !== "object" ||
+        Array.isArray(input) ||
+        Object.keys(input).length === 0)
+        throw new Error("Services file must be a nonempty JSON object.");
+    return Object.fromEntries(Object.entries(input).map(([name, block]) => [
+        name,
+        serviceDeploySchema.parse(block),
+    ]));
+};
+//# sourceMappingURL=parseSelection.js.map

package/dist/parseSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseSelection.js","sourceRoot":"","sources":["../src/parseSelection.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,KAAc,EACiB,EAAE;IACjC,IACE,CAAC,KAAK;QACN,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACpB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC;QAE/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACnE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;QAC3C,IAAI;QACJ,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC;KACjC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC"}

package/dist/parseSetupInput.d.ts

@@ -0,0 +1,16 @@
+export declare const parseSetupInput: (args: string[]) => {
+    slug: string;
+    options: {
+        "seen-service": boolean;
+        "seen-dockerfile": boolean;
+        "seen-repository": boolean;
+        service: string;
+        dockerfile: string;
+        dryRun: boolean;
+        repository?: string | undefined;
+        services?: string | undefined;
+        vercel?: string | undefined;
+    };
+    dry: boolean;
+};
+//# sourceMappingURL=parseSetupInput.d.ts.map

package/dist/parseSetupInput.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseSetupInput.d.ts","sourceRoot":"","sources":["../src/parseSetupInput.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,eAAe,GAAI,MAAM,MAAM,EAAE;;;;;;;;;;;;;;CA2B7C,CAAC"}

package/dist/parseSetupInput.js

@@ -0,0 +1,34 @@
+import { z } from "zod";
+import { createSetupCommand } from "./createSetupCommand.js";
+const schema = z.object({
+    service: z.string(),
+    dockerfile: z.string(),
+    repository: z.string().optional(),
+    services: z.string().optional(),
+    vercel: z.string().optional(),
+    dryRun: z.boolean().default(false),
+});
+export const parseSetupInput = (args) => {
+    const command = createSetupCommand()
+        .exitOverride()
+        .configureOutput({ writeErr: () => { } });
+    // Commander owns argument parsing; reject duplicate flags instead of silently taking the last value.
+    const flags = args.filter((value) => value.startsWith("--"));
+    if (new Set(flags).size !== flags.length)
+        throw new Error("Duplicate setup option.");
+    command.parse(args, { from: "user" });
+    const slug = z
+        .string()
+        .max(23)
+        .regex(/^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/)
+        .parse(command.args[0]);
+    const input = schema.parse(command.opts());
+    const options = {
+        ...input,
+        "seen-service": command.getOptionValueSource("service") === "cli",
+        "seen-dockerfile": command.getOptionValueSource("dockerfile") === "cli",
+        "seen-repository": command.getOptionValueSource("repository") === "cli",
+    };
+    return { slug, options, dry: input.dryRun };
+};
+//# sourceMappingURL=parseSetupInput.js.map

package/dist/parseSetupInput.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"parseSetupInput.js","sourceRoot":"","sources":["../src/parseSetupInput.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACtB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACjC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC/B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC7B,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACnC,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAc,EAAE,EAAE;IAChD,MAAM,OAAO,GAAG,kBAAkB,EAAE;SACjC,YAAY,EAAE;SACd,eAAe,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC,CAAC;IAE3C,qGAAqG;IACrG,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM;QACtC,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAEtC,MAAM,IAAI,GAAG,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,KAAK,CAAC,iCAAiC,CAAC;SACxC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAE1B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,OAAO,GAAG;QACd,GAAG,KAAK;QACR,cAAc,EAAE,OAAO,CAAC,oBAAoB,CAAC,SAAS,CAAC,KAAK,KAAK;QACjE,iBAAiB,EAAE,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,KAAK;QACvE,iBAAiB,EAAE,OAAO,CAAC,oBAAoB,CAAC,YAAY,CAAC,KAAK,KAAK;KACxE,CAAC;IAEF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC,CAAC"}

package/dist/readSelection.d.ts

@@ -0,0 +1,15 @@
+export declare const readSelection: (file: string, safe: (name: string) => string) => Record<string, {
+    module: string;
+    "depends-on": string[];
+    params: Record<string, unknown>;
+    env: string[];
+    domain?: string | undefined;
+    "dns-zone"?: string | undefined;
+    dockerfile?: string | undefined;
+    build?: string | undefined;
+    "deploy-path"?: string | undefined;
+    "remote-build"?: boolean | undefined;
+    "local-config"?: string | undefined;
+    "vercel-name"?: string | undefined;
+}>;
+//# sourceMappingURL=readSelection.d.ts.map

package/dist/readSelection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readSelection.d.ts","sourceRoot":"","sources":["../src/readSelection.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;;;;;;;;;;;;;EAyCzE,CAAC"}

package/dist/readSelection.js

@@ -0,0 +1,36 @@
+import { existsSync, readFileSync } from "node:fs";
+import { fail } from "./fail.js";
+import { parseSelection } from "./parseSelection.js";
+const read = (path) => readFileSync(path, "utf8");
+export const readSelection = (file, safe) => {
+    const input = JSON.parse(read(safe(file)));
+    const selection = parseSelection(input);
+    const supported = [
+        "cloud-run-web",
+        "gce-worker",
+        "vercel-static",
+        "shared-mongo-atlas",
+        "upstash-redis",
+        "aws-s3",
+    ];
+    for (const [name, block] of Object.entries(selection)) {
+        if (!/^[a-z][a-z0-9-]*$/.test(name) ||
+            ["gcp", "registry", "ci", "myshop"].includes(name) ||
+            /myshop/i.test(JSON.stringify(block)))
+            fail("Invalid service selection: MyShop is local-only and project module names are reserved.");
+        if (!supported.includes(block.module))
+            fail(`Unsupported starter module: ${block.module}. Use a reviewed custom Arc manifest.`);
+        if (["cloud-run-web", "gce-worker"].includes(block.module) &&
+            (!block.dockerfile || !existsSync(safe(block.dockerfile))))
+            fail(`Service ${name} requires an existing explicit Dockerfile.`);
+        if (["cloud-run-web", "vercel-static"].includes(block.module) &&
+            (!block.domain || !/^[a-z0-9.-]+$/.test(block.domain)))
+            fail(`Service ${name} requires an explicit domain.`);
+        if (block["deploy-path"])
+            safe(block["deploy-path"]);
+        if (block["local-config"])
+            safe(block["local-config"]);
+    }
+    return selection;
+};
+//# sourceMappingURL=readSelection.js.map

package/dist/readSelection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"readSelection.js","sourceRoot":"","sources":["../src/readSelection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,IAA8B,EAAE,EAAE;IAC5E,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAExC,MAAM,SAAS,GAAG;QAChB,eAAe;QACf,YAAY;QACZ,eAAe;QACf,oBAAoB;QACpB,eAAe;QACf,QAAQ;KACT,CAAC;IAEF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC/B,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YAErC,IAAI,CACF,wFAAwF,CACzF,CAAC;QACJ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACnC,IAAI,CACF,+BAA+B,KAAK,CAAC,MAAM,uCAAuC,CACnF,CAAC;QACJ,IACE,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACtD,CAAC,CAAC,KAAK,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAE1D,IAAI,CAAC,WAAW,IAAI,4CAA4C,CAAC,CAAC;QACpE,IACE,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;YACzD,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAEtD,IAAI,CAAC,WAAW,IAAI,+BAA+B,CAAC,CAAC;QACvD,IAAI,KAAK,CAAC,aAAa,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC;QACrD,IAAI,KAAK,CAAC,cAAc,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC"}

package/dist/renderPlan.d.ts

@@ -0,0 +1,27 @@
+import type { VercelConfig } from "./schemas.js";
+export declare const renderPlan: (config: VercelConfig, root: string) => {
+    mode: string;
+    account: {
+        type: "team" | "personal";
+        id: string;
+    };
+    approved: boolean;
+    terraform: boolean;
+    changesProjectSettings: boolean;
+    changesDNS: boolean;
+    sites: {
+        name: string;
+        operation: string;
+        projectId: string | null;
+        projectName: string;
+        build: string[];
+        output: string;
+        outputConfig: {
+            version: 3;
+            routes?: unknown[] | undefined;
+            overrides?: Record<string, unknown> | undefined;
+        };
+        deployment: string;
+    }[];
+};
+//# sourceMappingURL=renderPlan.d.ts.map

package/dist/renderPlan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderPlan.d.ts","sourceRoot":"","sources":["../src/renderPlan.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,eAAO,MAAM,UAAU,GAAI,QAAQ,YAAY,EAAE,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;CAuB5D,CAAC"}

package/dist/renderPlan.js

@@ -0,0 +1,25 @@
+import { validateConfig } from "./validateConfig.js";
+export const renderPlan = (config, root) => {
+    validateConfig(config, root);
+    return {
+        mode: "vercel",
+        account: config.account,
+        approved: config.approved,
+        terraform: false,
+        changesProjectSettings: false,
+        changesDNS: false,
+        sites: Object.entries(config.sites).map(([name, site]) => ({
+            name,
+            operation: site.mode === "new"
+                ? "explicit-create-required-before-deploy"
+                : "reference-existing",
+            projectId: site.projectId ?? null,
+            projectName: site.projectName,
+            build: site.build,
+            output: site.output,
+            outputConfig: site.outputConfig,
+            deployment: "prebuilt-static",
+        })),
+    };
+};
+//# sourceMappingURL=renderPlan.js.map

package/dist/renderPlan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderPlan.js","sourceRoot":"","sources":["../src/renderPlan.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAoB,EAAE,IAAY,EAAE,EAAE;IAC/D,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,KAAK;QAChB,sBAAsB,EAAE,KAAK;QAC7B,UAAU,EAAE,KAAK;QACjB,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACzD,IAAI;YACJ,SAAS,EACP,IAAI,CAAC,IAAI,KAAK,KAAK;gBACjB,CAAC,CAAC,wCAAwC;gBAC1C,CAAC,CAAC,oBAAoB;YAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI;YACjC,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,iBAAiB;SAC9B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC,CAAC"}

package/dist/renderResult.d.ts

@@ -0,0 +1,5 @@
+export declare const renderResult: (value: unknown, options: {
+    json?: boolean;
+    jsonl?: boolean;
+}) => string;
+//# sourceMappingURL=renderResult.d.ts.map

package/dist/renderResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderResult.d.ts","sourceRoot":"","sources":["../src/renderResult.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,YAAY,GACvB,OAAO,OAAO,EACd,SAAS;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,WAe7C,CAAC"}

package/dist/renderResult.js

@@ -0,0 +1,15 @@
+export const renderResult = (value, options) => {
+    if (options.json && options.jsonl)
+        throw new Error("Choose either --json or --jsonl.");
+    if (options.jsonl)
+        return JSON.stringify({ type: "command.completed", result: value });
+    if (options.json)
+        return JSON.stringify(value);
+    if (value &&
+        typeof value === "object" &&
+        "message" in value &&
+        typeof value.message === "string")
+        return value.message;
+    return JSON.stringify(value, null, 2);
+};
+//# sourceMappingURL=renderResult.js.map

package/dist/renderResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"renderResult.js","sourceRoot":"","sources":["../src/renderResult.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,KAAc,EACd,OAA4C,EAC5C,EAAE;IACF,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK;QAC/B,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,IAAI,OAAO,CAAC,KAAK;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ;QAEjC,OAAO,KAAK,CAAC,OAAO,CAAC;IACvB,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACxC,CAAC,CAAC"}

package/dist/resolveRepository.d.ts

@@ -0,0 +1,2 @@
+export declare const resolveRepository: (root: string, configured?: string) => string;
+//# sourceMappingURL=resolveRepository.d.ts.map

package/dist/resolveRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRepository.d.ts","sourceRoot":"","sources":["../src/resolveRepository.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,iBAAiB,GAC5B,MAAM,MAAM,EACZ,aAAa,MAAM,KAClB,MA+BF,CAAC"}

package/dist/resolveRepository.js

@@ -0,0 +1,24 @@
+import { execFileSync } from "node:child_process";
+import { fail } from "./fail.js";
+export const resolveRepository = (root, configured) => {
+    let repository = configured;
+    if (!repository) {
+        let origin;
+        try {
+            origin = execFileSync("git", ["remote", "get-url", "origin"], {
+                cwd: root,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"],
+            }).trim();
+        }
+        catch {
+            fail("Cannot read Git origin. Pass --repository owner/repo.");
+        }
+        repository =
+            /^(?:git@github\.com:|https:\/\/github\.com\/)([^/]+\/[^/]+?)(?:\.git)?$/.exec(origin)?.[1];
+    }
+    if (!/^[A-Za-z0-9][A-Za-z0-9-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/.test(repository ?? ""))
+        fail("Repository must be an explicit GitHub owner/repo (or a GitHub origin).");
+    return repository;
+};
+//# sourceMappingURL=resolveRepository.js.map

package/dist/resolveRepository.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolveRepository.js","sourceRoot":"","sources":["../src/resolveRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAC/B,IAAY,EACZ,UAAmB,EACX,EAAE;IACV,IAAI,UAAU,GAAG,UAAU,CAAC;IAE5B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,IAAI,MAAM,CAAC;QAEX,IAAI,CAAC;YACH,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE;gBAC5D,GAAG,EAAE,IAAI;gBACT,QAAQ,EAAE,MAAM;gBAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,IAAI,EAAE,CAAC;QACZ,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,CAAC;QAED,UAAU;YACR,yEAAyE,CAAC,IAAI,CAC5E,MAAO,CACR,EAAE,CAAC,CAAC,CAAC,CAAC;IACX,CAAC;IAED,IACE,CAAC,wDAAwD,CAAC,IAAI,CAC5D,UAAU,IAAI,EAAE,CACjB;QAED,IAAI,CACF,wEAAwE,CACzE,CAAC;IACJ,OAAO,UAAW,CAAC;AACrB,CAAC,CAAC"}

package/dist/runProcess.d.ts

@@ -0,0 +1,2 @@
+export declare const runProcess: (command: string, args: string[], cwd: string, env: NodeJS.ProcessEnv, machine?: boolean, input?: string) => void;
+//# sourceMappingURL=runProcess.d.ts.map

package/dist/runProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runProcess.d.ts","sourceRoot":"","sources":["../src/runProcess.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,UAAU,GACrB,SAAS,MAAM,EACf,MAAM,MAAM,EAAE,EACd,KAAK,MAAM,EACX,KAAK,MAAM,CAAC,UAAU,EACtB,iBAAe,EACf,QAAQ,MAAM,SAiBf,CAAC"}

package/dist/runProcess.js

@@ -0,0 +1,16 @@
+import { spawnSync } from "node:child_process";
+export const runProcess = (command, args, cwd, env, machine = false, input) => {
+    const result = spawnSync(command, args, {
+        cwd,
+        env,
+        input,
+        stdio: [
+            input === undefined ? "ignore" : "pipe",
+            machine ? 2 : "inherit",
+            "inherit",
+        ],
+    });
+    if (result.error || result.status !== 0)
+        throw new Error(`${command} failed (${result.status ?? "could not start"}). No automatic retry; earlier cloud changes may have succeeded.`);
+};
+//# sourceMappingURL=runProcess.js.map

package/dist/runProcess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runProcess.js","sourceRoot":"","sources":["../src/runProcess.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,MAAM,CAAC,MAAM,UAAU,GAAG,CACxB,OAAe,EACf,IAAc,EACd,GAAW,EACX,GAAsB,EACtB,OAAO,GAAG,KAAK,EACf,KAAc,EACd,EAAE;IACF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE;QACtC,GAAG;QACH,GAAG;QACH,KAAK;QACL,KAAK,EAAE;YACL,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YACvC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;YACvB,SAAS;SACV;KACF,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,YAAY,MAAM,CAAC,MAAM,IAAI,iBAAiB,kEAAkE,CAC3H,CAAC;AACN,CAAC,CAAC"}

package/dist/runTerraform.d.ts

@@ -0,0 +1,8 @@
+export declare const runTerraform: (command: "check" | "plan" | "deploy", root: string, machine?: boolean) => {
+    operation: "check";
+    message: string;
+} | {
+    operation: "plan" | "deploy";
+    message: string;
+};
+//# sourceMappingURL=runTerraform.d.ts.map

package/dist/runTerraform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runTerraform.d.ts","sourceRoot":"","sources":["../src/runTerraform.ts"],"names":[],"mappings":"AAsBA,eAAO,MAAM,YAAY,GACvB,SAAS,OAAO,GAAG,MAAM,GAAG,QAAQ,EACpC,MAAM,MAAM,EACZ,iBAAe;;;;;;CA4JhB,CAAC"}

package/dist/runTerraform.js

@@ -0,0 +1,111 @@
+import { loadManifest } from "@mp-lb/zapper/dist/arc/manifest.js";
+import { resolveModules } from "@mp-lb/zapper/dist/arc/modules.js";
+import { deployBlockSchema, networkConfigSchema, } from "@mp-lb/zapper/dist/arc/schemas.js";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
+import { createRequire } from "node:module";
+import { devNull, tmpdir } from "node:os";
+import { dirname, join, resolve } from "node:path";
+import { parse } from "yaml";
+import { runProcess } from "./runProcess.js";
+import { envPoolSchema, terraformConfigSchema } from "./schemas.js";
+const require = createRequire(import.meta.url);
+export const runTerraform = (command, root, machine = false) => {
+    const here = join(root, ".arcnet");
+    const read = (name) => readFileSync(join(here, name), "utf8");
+    const config = terraformConfigSchema.parse(JSON.parse(read("project.json")));
+    const zap = parse(readFileSync(join(root, "zap.yaml"), "utf8"));
+    const network = networkConfigSchema.parse(parse(read("network.yaml")));
+    const deployment = deployBlockSchema.parse(zap.deploy);
+    if (config.version !== 1 || zap.project !== config.slug)
+        throw new Error("Project config does not match zap.yaml.");
+    const services = Object.keys(deployment?.services ?? {});
+    if (JSON.stringify(services.sort()) !==
+        JSON.stringify([...config.services].sort()) ||
+        /myshop/i.test(JSON.stringify(deployment.services)))
+        throw new Error("Service selection differs or includes local-only MyShop. Review scope before deployment.");
+    const blocks = Object.values(deployment.services);
+    for (const service of blocks)
+        if (["cloud-run-web", "gce-worker"].includes(service.module) &&
+            (!service.dockerfile || !existsSync(join(root, service.dockerfile))))
+            throw new Error("Container Dockerfile is missing.");
+    if (deployment.project?.ci?.params?.repository !== config.repository)
+        throw new Error("Deployment manifest repository differs from project config.");
+    const publicEnv = existsSync(join(here, "env.production.json"))
+        ? JSON.parse(read("env.production.json"))
+        : {};
+    let secretEnv;
+    try {
+        secretEnv = JSON.parse(process.env.ARCNET_ENV_JSON || "{}");
+    }
+    catch {
+        throw new Error("ARCNET_ENV_JSON must be valid JSON (value omitted).");
+    }
+    for (const pool of [publicEnv, secretEnv])
+        if (!pool ||
+            Array.isArray(pool) ||
+            typeof pool !== "object" ||
+            Object.entries(pool).some(([k, v]) => !/^[A-Z_][A-Z0-9_]*$/.test(k) || typeof v !== "string"))
+            throw new Error("Environment pools must be JSON objects mapping environment names to strings.");
+    const envPool = {
+        ...envPoolSchema.parse(publicEnv),
+        ...envPoolSchema.parse(secretEnv),
+    };
+    if (command === "check") {
+        return {
+            operation: command,
+            message: "Offline config check passed. Cloud access, image runtime and live deployment have NOT been verified.",
+        };
+    }
+    if (command === "deploy" && config.approved !== true)
+        throw new Error("Deployment disabled. Complete prerequisites and obtain target/cost/IAM/DNS approval before committing approved=true.");
+    if (process.env.GITHUB_ACTIONS === "true") {
+        if (process.env.GITHUB_REPOSITORY !== config.repository ||
+            process.env.GITHUB_REF !== "refs/heads/main")
+            throw new Error("CI deployment is restricted to the configured repository main branch.");
+        if (!/^projects\/\d+\/locations\/global\/workloadIdentityPools\/github\/providers\/github-actions$/.test(config.workloadIdentityProvider))
+            throw new Error("Set workloadIdentityProvider from the approved first deployment.");
+    }
+    const modulesDir = resolve(dirname(require.resolve("@mp-lb/zapper")), "../arc");
+    const instances = resolveModules(loadManifest(root), modulesDir, root);
+    for (const instance of instances)
+        for (const credential of instance.manifest.credentials)
+            if (!process.env[credential.name])
+                throw new Error(`${credential.name} is required for ${instance.key}; supply a scoped operator credential through environment, never commit it.`);
+    if (JSON.stringify(network).includes("REPLACE_"))
+        throw new Error("Network contains REPLACE_ placeholders. Commit reviewed network/billing settings before planning or deployment.");
+    const missing = blocks
+        .flatMap((service) => service.env ?? [])
+        .filter((key) => !key.includes("=") && !Object.hasOwn(envPool, key));
+    if (missing.length)
+        throw new Error(`Missing app environment keys: ${missing.join(", ")}. Supply ARCNET_ENV_JSON or committed public env.`);
+    for (const tool of [
+        "terraform",
+        "gcloud",
+        ...(blocks.some((s) => ["cloud-run-web", "gce-worker"].includes(s.module))
+            ? ["docker"]
+            : []),
+    ])
+        if (spawnSync(tool, ["--version"], { stdio: "ignore" }).status !== 0)
+            throw new Error(`Required executable unavailable: ${tool}. See StackForge ArcNet prerequisites.`);
+    const executable = require.resolve("@mp-lb/zapper");
+    // The engine requires a file for operator configuration. Keep this transient,
+    // and explicitly disable its machine-global credentials fallback.
+    const temporary = mkdtempSync(join(tmpdir(), "arcnet-operator-"));
+    try {
+        const operator = join(temporary, "operator.json");
+        writeFileSync(operator, JSON.stringify({ credentials: devNull }), {
+            mode: 0o600,
+        });
+        runProcess(process.execPath, [executable, "arc", command], root, {
+            ...process.env,
+            ZAP_ARC_NETWORK_FILE: join(here, "network.yaml"),
+            ZAP_ARC_CONFIG: operator,
+        }, machine, JSON.stringify(envPool));
+        return { operation: command, message: `Zap Arc ${command} completed.` };
+    }
+    finally {
+        rmSync(temporary, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=runTerraform.js.map

package/dist/runTerraform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runTerraform.js","sourceRoot":"","sources":["../src/runTerraform.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oCAAoC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAC;AACnE,OAAO,EACL,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,WAAW,EACX,YAAY,EACZ,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAAoC,EACpC,IAAY,EACZ,OAAO,GAAG,KAAK,EACf,EAAE;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;IACtE,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,IAAI;QACrD,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC;IACzD,IACE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QAEnD,MAAM,IAAI,KAAK,CACb,0FAA0F,CAC3F,CAAC;IACJ,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClD,KAAK,MAAM,OAAO,IAAI,MAAM;QAC1B,IACE,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;YACxD,CAAC,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAEpE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,KAAK,MAAM,CAAC,UAAU;QAClE,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IAEJ,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QACtE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,SAAS,CAAC;IAEd,IAAI,CAAC;QACH,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC;QACvC,IACE,CAAC,IAAI;YACL,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACnB,OAAO,IAAI,KAAK,QAAQ;YACxB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CACvB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,CACnE;YAED,MAAM,IAAI,KAAK,CACb,8EAA8E,CAC/E,CAAC;IAEN,MAAM,OAAO,GAAG;QACd,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;QACjC,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC;KAClC,CAAC;IAEF,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,OAAO,EACL,sGAAsG;SACzG,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAClD,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IAEJ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM,EAAE,CAAC;QAC1C,IACE,OAAO,CAAC,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU;YACnD,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,iBAAiB;YAE5C,MAAM,IAAI,KAAK,CACb,uEAAuE,CACxE,CAAC;QACJ,IACE,CAAC,8FAA8F,CAAC,IAAI,CAClG,MAAM,CAAC,wBAAwB,CAChC;YAED,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACN,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CACxB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,EACzC,QAAQ,CACT,CAAC;IAEF,MAAM,SAAS,GAAG,cAAc,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IACvE,KAAK,MAAM,QAAQ,IAAI,SAAS;QAC9B,KAAK,MAAM,UAAU,IAAI,QAAQ,CAAC,QAAQ,CAAC,WAAW;YACpD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,CAAC,IAAI,oBAAoB,QAAQ,CAAC,GAAG,6EAA6E,CAChI,CAAC;IACR,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,iHAAiH,CAClH,CAAC;IAEJ,MAAM,OAAO,GAAG,MAAM;SACnB,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,IAAI,EAAE,CAAC;SACvC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAEvE,IAAI,OAAO,CAAC,MAAM;QAChB,MAAM,IAAI,KAAK,CACb,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mDAAmD,CACvG,CAAC;IACJ,KAAK,MAAM,IAAI,IAAI;QACjB,WAAW;QACX,QAAQ;QACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YACxE,CAAC,CAAC,CAAC,QAAQ,CAAC;YACZ,CAAC,CAAC,EAAE,CAAC;KACR;QACC,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,KAAK,CAAC;YAClE,MAAM,IAAI,KAAK,CACb,oCAAoC,IAAI,wCAAwC,CACjF,CAAC;IACN,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACpD,8EAA8E;IAC9E,kEAAkE;IAClE,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAElE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAAE;YAChE,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,UAAU,CACR,OAAO,CAAC,QAAQ,EAChB,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,EAC5B,IAAI,EACJ;YACE,GAAG,OAAO,CAAC,GAAG;YACd,oBAAoB,EAAE,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;YAChD,cAAc,EAAE,QAAQ;SACzB,EACD,OAAO,EACP,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CACxB,CAAC;QAEF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,OAAO,aAAa,EAAE,CAAC;IAC1E,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,CAAC;AACH,CAAC,CAAC"}

package/dist/runVercel.d.ts

@@ -0,0 +1,34 @@
+export declare const runVercel: (command: string, root: string, argument?: string, machine?: boolean) => Promise<{
+    mode: string;
+    account: {
+        type: "team" | "personal";
+        id: string;
+    };
+    approved: boolean;
+    terraform: boolean;
+    changesProjectSettings: boolean;
+    changesDNS: boolean;
+    sites: {
+        name: string;
+        operation: string;
+        projectId: string | null;
+        projectName: string;
+        build: string[];
+        output: string;
+        outputConfig: {
+            version: 3;
+            routes?: unknown[] | undefined;
+            overrides?: Record<string, unknown> | undefined;
+        };
+        deployment: string;
+    }[];
+} | {
+    operation: string;
+    message: string;
+    projectId?: undefined;
+} | {
+    operation: string;
+    projectId: string | undefined;
+    message: string;
+}>;
+//# sourceMappingURL=runVercel.d.ts.map

package/dist/runVercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runVercel.d.ts","sourceRoot":"","sources":["../src/runVercel.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,SAAS,GACpB,SAAS,MAAM,EACf,MAAM,MAAM,EACZ,WAAW,MAAM,EACjB,iBAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8DhB,CAAC"}

package/dist/runVercel.js

@@ -0,0 +1,52 @@
+import { readFileSync, renameSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { apiClient } from "./apiClient.js";
+import { createProject } from "./createProject.js";
+import { deploy } from "./deploy.js";
+import { inspectReferences } from "./inspectReferences.js";
+import { renderPlan } from "./renderPlan.js";
+import { runProcess } from "./runProcess.js";
+import { validateConfig } from "./validateConfig.js";
+export const runVercel = async (command, root, argument, machine = false) => {
+    const path = join(root, ".arcnet/project.json");
+    const original = readFileSync(path, "utf8");
+    const config = validateConfig(JSON.parse(original), root);
+    if (command === "check" || command === "plan")
+        return renderPlan(config, root);
+    if (command === "create" && process.env.GITHUB_ACTIONS === "true")
+        throw new Error("Project creation is a separate local operator step, never a CI side effect.");
+    if (["deploy", "preview"].includes(command) && !config.approved)
+        throw new Error("Deployment disabled (approved=false). No remote calls made.");
+    const request = apiClient(process.env.VERCEL_TOKEN);
+    if (command === "inspect") {
+        await inspectReferences(config, request);
+        return {
+            operation: command,
+            message: "All existing project IDs, names and account scopes match. No settings or DNS changed.",
+        };
+    }
+    if (command === "create") {
+        if (!argument)
+            throw new Error("Choose a configured site.");
+        const next = await createProject(config, argument, request);
+        if (next === config)
+            return {
+                operation: command,
+                message: "Already an existing reference; identity verified, nothing created.",
+            };
+        if (readFileSync(path, "utf8") !== original)
+            throw new Error(`Config changed during creation. Recover the created project ID ${next.sites[argument].projectId} manually; no local settings overwritten.`);
+        writeFileSync(`${path}.new`, JSON.stringify(next, null, 2) + "\n", {
+            flag: "wx",
+        });
+        renameSync(`${path}.new`, path);
+        return {
+            operation: command,
+            projectId: next.sites[argument].projectId,
+            message: "Created project; review and commit project.json before CI. Deployment remains disabled.",
+        };
+    }
+    await deploy(config, root, request, (cmd, args, cwd, env) => runProcess(cmd, args, cwd, env, machine), process.env, command === "preview" ? "preview" : "production");
+    return { operation: command, message: "Selected static sites deployed." };
+};
+//# sourceMappingURL=runVercel.js.map

package/dist/runVercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runVercel.js","sourceRoot":"","sources":["../src/runVercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAC5B,OAAe,EACf,IAAY,EACZ,QAAiB,EACjB,OAAO,GAAG,KAAK,EACf,EAAE;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1D,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,MAAM;QAC3C,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,MAAM;QAC/D,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;QAC7D,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAEpD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,OAAO,EACL,uFAAuF;SAC1F,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5D,IAAI,IAAI,KAAK,MAAM;YACjB,OAAO;gBACL,SAAS,EAAE,OAAO;gBAClB,OAAO,EACL,oEAAoE;aACvE,CAAC;QACJ,IAAI,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,QAAQ;YACzC,MAAM,IAAI,KAAK,CACb,kEAAkE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,SAAS,2CAA2C,CAC7I,CAAC;QACJ,aAAa,CAAC,GAAG,IAAI,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YACjE,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;QAEH,UAAU,CAAC,GAAG,IAAI,MAAM,EAAE,IAAI,CAAC,CAAC;QAChC,OAAO;YACL,SAAS,EAAE,OAAO;YAClB,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAE,CAAC,SAAS;YAC1C,OAAO,EACL,yFAAyF;SAC5F,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,CACV,MAAM,EACN,IAAI,EACJ,OAAO,EACP,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EACjE,OAAO,CAAC,GAAG,EACX,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CACjD,CAAC;IAEF,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC;AAC5E,CAAC,CAAC"}

package/dist/safePath.d.ts

@@ -0,0 +1,2 @@
+export declare const safePath: (root: string, name: string) => string;
+//# sourceMappingURL=safePath.d.ts.map

package/dist/safePath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePath.d.ts","sourceRoot":"","sources":["../src/safePath.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,WAsClD,CAAC"}

package/dist/safePath.js

@@ -0,0 +1,35 @@
+import { lstatSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { fail } from "./fail.js";
+export const safePath = (root, name) => {
+    if (typeof name !== "string" ||
+        !name ||
+        isAbsolute(name) ||
+        name.includes("\\"))
+        fail("Expected a project-relative path.");
+    const target = resolve(root, name), rel = relative(root, target);
+    if (!rel ||
+        rel === ".." ||
+        rel.startsWith("../") ||
+        rel
+            .split("/")
+            .some((p) => [".git", "node_modules", ".arcnet"].includes(p)) ||
+        /^apps\/myshop(?:\/|$)/i.test(rel))
+        fail(`Unsafe or local-only artifact path: ${name}`);
+    let at = root;
+    for (const part of rel.split("/")) {
+        at = join(at, part);
+        let stat;
+        try {
+            stat = lstatSync(at);
+        }
+        catch (e) {
+            if (e.code !== "ENOENT")
+                throw e;
+        }
+        if (stat?.isSymbolicLink())
+            fail(`Symlink not allowed: ${name}`);
+    }
+    return target;
+};
+//# sourceMappingURL=safePath.js.map

package/dist/safePath.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../src/safePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE;IACrD,IACE,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,IAAI;QACL,UAAU,CAAC,IAAI,CAAC;QAChB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAEnB,IAAI,CAAC,mCAAmC,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAChC,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAE/B,IACE,CAAC,GAAG;QACJ,GAAG,KAAK,IAAI;QACZ,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;QACrB,GAAG;aACA,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC/D,wBAAwB,CAAC,IAAI,CAAC,GAAG,CAAC;QAElC,IAAI,CAAC,uCAAuC,IAAI,EAAE,CAAC,CAAC;IACtD,IAAI,EAAE,GAAG,IAAI,CAAC;IAEd,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,EAAE,GAAG,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACpB,IAAI,IAAI,CAAC;QAET,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,IAAI,EAAE,cAAc,EAAE;YAAE,IAAI,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}

package/dist/safeTargetPath.d.ts

@@ -0,0 +1,2 @@
+export declare const safeTargetPath: (root: string, name: string) => string;
+//# sourceMappingURL=safeTargetPath.d.ts.map

package/dist/safeTargetPath.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safeTargetPath.d.ts","sourceRoot":"","sources":["../src/safeTargetPath.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,cAAc,GAAI,MAAM,MAAM,EAAE,MAAM,MAAM,WA2BxD,CAAC"}

package/dist/safeTargetPath.js

@@ -0,0 +1,29 @@
+import { lstatSync } from "node:fs";
+import { isAbsolute, join, relative, resolve } from "node:path";
+import { fail } from "./fail.js";
+export const safeTargetPath = (root, name) => {
+    const target = resolve(root, name);
+    if (!name ||
+        isAbsolute(name) ||
+        relative(root, target) === ".." ||
+        relative(root, target).startsWith("../"))
+        fail(`Path must stay within the project: ${name}`);
+    let at = root;
+    for (const part of relative(root, target).split("/")) {
+        at = join(at, part);
+        let stat;
+        try {
+            stat = lstatSync(at);
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                throw error;
+        }
+        if (stat?.isSymbolicLink())
+            fail(`Refusing symlink: ${name}`);
+        if (stat && at !== target && !stat.isDirectory())
+            fail(`Parent path is not a directory: ${name}`);
+    }
+    return target;
+};
+//# sourceMappingURL=safeTargetPath.js.map