@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/README.md

@@ -1,3 +1,49 @@
-# Temporary Holding Version
+# @mp-lb/arcnet
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+ArcNet's TypeScript CLI for installing deployment configuration and deploying projects. The package owns shared runners, validation, workflow templates and the Vercel Terraform module; projects keep configuration and application-specific Dockerfiles.
+
+From an existing project with Zap, GitHub, and pinned pnpm:
+
+```sh
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world --dry-run
+pnpm dlx @mp-lb/arcnet@0.2.0 setup hello-world
+pnpm install
+pnpm exec arcnet check
+```
+
+Setup pins this package in the existing root manifest. Commit the resulting lockfile. Deployment starts disabled, and setup never provisions cloud resources. Upgrades use the project's normal dependency workflow.
+
+[Project setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/SETUP.md) · [Environment setup](https://github.com/mp-lb/stackforge/blob/main/arcnet/environment/setup.md) · [Audit](https://github.com/mp-lb/stackforge/blob/main/arcnet/AUDIT.md) · [Command reference](docs/public/commands.md)
+
+Zap Arc remains the pinned Terraform engine dependency. Environment bootstrap, health checks and teardown are not implemented by this package yet. The static Vercel adapter retains its existing static-only and explicit-project-reference limitations.
+
+## Layered secrets
+
+`arcnet secrets add` attaches an existing Forum encrypted JSON file. `arcnet secrets init` creates one. Both register a file-specific decryption key in the selected GitHub repository, save an encrypted snapshot, and generate a validation workflow. Setup prompts for your Forum encryption password locally; it never prints the password or recipient key. Use `--existing-key` when the GitHub secret already exists. The local `fm` and `gh` CLIs must be authenticated; the selected Forum parent directory must exist.
+
+The project keeps only `.arcnet/secrets.json`, encrypted snapshots under `.arcnet/secrets/`, and workflow references. Sources merge left to right, with later values winning. Each source names its own key environment variable. JSON must be an object; unused structured values are allowed, while selected environment values must be nonempty strings. Consumer mappings select and rename fields; an array of source names accepts aliases only when their values agree.
+
+```json
+{
+  "version": 1,
+  "repository": "example/hello-world",
+  "sources": [
+    { "name": "standard", "store": "example/company", "path": "/admin/standard.json.enc", "keyEnv": "STANDARD_SECRETS_KEY" },
+    { "name": "project", "store": "example/company", "path": "/admin/hello-world.json.enc", "keyEnv": "PROJECT_SECRETS_KEY" }
+  ],
+  "consumers": {
+    "publish": { "NODE_AUTH_TOKEN": ["NPM_TOKEN", "NODE_AUTH_TOKEN"] },
+    "deploy": { "VERCEL_TOKEN": "VERCEL_API_TOKEN" }
+  }
+}
+```
+
+`secrets sync` fetches ciphertext and adds snapshot identity, revision and checksum to this configuration. Commit config and ciphertext together. CI uses the reviewed snapshots and needs only each file's decryption key, not a Forum login. Sync after editing or rotating a source; obsolete snapshots can be removed after checking that no configuration references them. Setup/sync also wire source-key references into workflow steps that call ArcNet's env or deployment commands.
+
+For live loading, omit a snapshot or select `--live`: the installed `fm` CLI fetches each source using its local login or the source's optional `tokenEnv` access credential. A decryption recipient is **not** a Forum read token. Live CI therefore needs an installed, authenticated `fm` as well as the independent decryption keys. Generated CI intentionally uses snapshots.
+
+`arcnet env check` reports source names and selected key names, never values. `arcnet env export` explicitly emits selected plaintext JSON. `arcnet env run` gives a subprocess only the selected values and a small execution environment; it removes file keys, isolates temporary HOME/cache paths, and withholds subprocess output. Keep npm publishing mappings scoped to publishing credentials. The command reference documents the exact options.
+
+When `.arcnet/secrets.json` exists, deployment commands automatically load it. The `deploy` consumer selects operator credentials; Terraform application values are selected using the existing service env lists in `zap.yaml`. No duplicated application map is required. Offline project checks remain offline. Secrets commands in GitHub Actions require the configured repository's main branch.
+
+Provisioning modifies Forum and GitHub separately. A failed GitHub upload leaves an unused Forum recipient; rerun `secrets add` to create/upload another and remove the unused recipient later. If upload succeeded but snapshot/config writing failed, attach the file with `--existing-key`. Existing sources are not silently rotated on reruns. Provision while nobody else is editing that file: the current fm write interface does not offer atomic revision-conditional writes, though ArcNet checks identity/revision before updating and refuses occupied init paths. GitHub secret names are repository-scoped; environment-level overrides take precedence in jobs that use an environment.

package/dist/addDependency.d.ts

@@ -0,0 +1,3 @@
+export declare const addDependency: (path: string) => string;
+export declare const hasDependency: (root: string) => boolean;
+//# sourceMappingURL=addDependency.d.ts.map

package/dist/addDependency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"addDependency.d.ts","sourceRoot":"","sources":["../src/addDependency.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,WAiBzC,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,YASzC,CAAC"}

package/dist/addDependency.js

@@ -0,0 +1,29 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { packageVersion } from "./packageInfo.js";
+const manifestSchema = z
+    .object({
+    dependencies: z.record(z.string(), z.string()).optional(),
+    devDependencies: z.record(z.string(), z.string()).optional(),
+})
+    .passthrough();
+export const addDependency = (path) => {
+    const manifest = manifestSchema.parse(JSON.parse(readFileSync(path, "utf8")));
+    const existing = manifest.dependencies?.["@mp-lb/arcnet"] ??
+        manifest.devDependencies?.["@mp-lb/arcnet"];
+    if (existing && existing !== packageVersion)
+        throw new Error("Existing ArcNet dependency differs; review its version before setup.");
+    if (!manifest.dependencies?.["@mp-lb/arcnet"])
+        manifest.devDependencies = {
+            ...manifest.devDependencies,
+            "@mp-lb/arcnet": packageVersion,
+        };
+    return JSON.stringify(manifest, null, 2) + "\n";
+};
+export const hasDependency = (root) => {
+    const manifest = manifestSchema.parse(JSON.parse(readFileSync(join(root, "package.json"), "utf8")));
+    return Boolean(manifest.dependencies?.["@mp-lb/arcnet"] ??
+        manifest.devDependencies?.["@mp-lb/arcnet"]);
+};
+//# sourceMappingURL=addDependency.js.map

package/dist/addDependency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addDependency.js","sourceRoot":"","sources":["../src/addDependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,MAAM,cAAc,GAAG,CAAC;KACrB,MAAM,CAAC;IACN,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;IACzD,eAAe,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;CAC7D,CAAC;KACD,WAAW,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE9E,MAAM,QAAQ,GACZ,QAAQ,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC;QACxC,QAAQ,CAAC,eAAe,EAAE,CAAC,eAAe,CAAC,CAAC;IAE9C,IAAI,QAAQ,IAAI,QAAQ,KAAK,cAAc;QACzC,MAAM,IAAI,KAAK,CACb,sEAAsE,CACvE,CAAC;IACJ,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC;QAC3C,QAAQ,CAAC,eAAe,GAAG;YACzB,GAAG,QAAQ,CAAC,eAAe;YAC3B,eAAe,EAAE,cAAc;SAChC,CAAC;IACJ,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAClD,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE;IAC5C,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CACnC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAC7D,CAAC;IAEF,OAAO,OAAO,CACZ,QAAQ,CAAC,YAAY,EAAE,CAAC,eAAe,CAAC;QACxC,QAAQ,CAAC,eAAe,EAAE,CAAC,eAAe,CAAC,CAC5C,CAAC;AACJ,CAAC,CAAC"}

package/dist/apiClient.d.ts

@@ -0,0 +1,3 @@
+import type { VercelRequest } from "./schemas.js";
+export declare const apiClient: (token: string | undefined, fetcher?: typeof fetch) => VercelRequest;
+//# sourceMappingURL=apiClient.d.ts.map

package/dist/apiClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.d.ts","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,eAAO,MAAM,SAAS,GACpB,OAAO,MAAM,GAAG,SAAS,EACzB,UAAS,OAAO,KAAa,KAC5B,aA2CF,CAAC"}

package/dist/apiClient.js

@@ -0,0 +1,39 @@
+import { fail } from "./fail.js";
+import { vercelResponseSchema } from "./schemas.js";
+export const apiClient = (token, fetcher = fetch) => {
+    if (!token)
+        fail("VERCEL_TOKEN is required for remote operations; check and plan remain offline.");
+    return async (method, path, account, body) => {
+        const url = new URL(path, "https://api.vercel.com");
+        if (account.type === "team")
+            url.searchParams.set("teamId", account.id);
+        let response;
+        try {
+            response = await fetcher(url, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${token}`,
+                    "Content-Type": "application/json",
+                },
+                body: body === undefined ? undefined : JSON.stringify(body),
+                signal: AbortSignal.timeout(30000),
+            });
+        }
+        catch {
+            fail(method === "POST"
+                ? "Creation outcome uncertain. Inspect the named project before retrying; no automatic retry was attempted."
+                : "Vercel read failed; no changes attempted.");
+        }
+        if (response.status === 404 && method === "GET")
+            return null;
+        if (!response.ok)
+            fail(`Vercel ${method} failed (HTTP ${response.status}). Check scope/access; response content omitted.`);
+        try {
+            return vercelResponseSchema.parse(await response.json());
+        }
+        catch {
+            fail("Vercel returned an invalid response; inspect the project before retrying.");
+        }
+    };
+};
+//# sourceMappingURL=apiClient.js.map

package/dist/apiClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiClient.js","sourceRoot":"","sources":["../src/apiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,KAAyB,EACzB,UAAwB,KAAK,EACd,EAAE;IACjB,IAAI,CAAC,KAAK;QACR,IAAI,CACF,gFAAgF,CACjF,CAAC;IAEJ,OAAO,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,QAAQ,CAAC;QAEb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;gBAC5B,MAAM;gBACN,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,cAAc,EAAE,kBAAkB;iBACnC;gBACD,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC3D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CACF,MAAM,KAAK,MAAM;gBACf,CAAC,CAAC,0GAA0G;gBAC5G,CAAC,CAAC,2CAA2C,CAChD,CAAC;QACJ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;YACd,IAAI,CACF,UAAU,MAAM,iBAAiB,QAAQ,CAAC,MAAM,kDAAkD,CACnG,CAAC;QAEJ,IAAI,CAAC;YACH,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CACF,2EAA2E,CAC5E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC,CAAC"}

package/dist/checkIdentity.d.ts

@@ -0,0 +1,3 @@
+import type { VercelAccount, VercelResponse, VercelSite } from "./schemas.js";
+export declare const checkIdentity: (project: VercelResponse | null, site: VercelSite, account: VercelAccount) => void;
+//# sourceMappingURL=checkIdentity.d.ts.map

package/dist/checkIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkIdentity.d.ts","sourceRoot":"","sources":["../src/checkIdentity.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9E,eAAO,MAAM,aAAa,GACxB,SAAS,cAAc,GAAG,IAAI,EAC9B,MAAM,UAAU,EAChB,SAAS,aAAa,SAWvB,CAAC"}

package/dist/checkIdentity.js

@@ -0,0 +1,9 @@
+import { fail } from "./fail.js";
+export const checkIdentity = (project, site, account) => {
+    if (!project ||
+        project.id !== site.projectId ||
+        project.name !== site.projectName ||
+        project.accountId !== account.id)
+        fail(`Project identity/scope mismatch for ${site.projectName}. No deployment attempted.`);
+};
+//# sourceMappingURL=checkIdentity.js.map

package/dist/checkIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkIdentity.js","sourceRoot":"","sources":["../src/checkIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,OAA8B,EAC9B,IAAgB,EAChB,OAAsB,EACtB,EAAE;IACF,IACE,CAAC,OAAO;QACR,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,SAAS;QAC7B,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW;QACjC,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,EAAE;QAEhC,IAAI,CACF,uCAAuC,IAAI,CAAC,WAAW,4BAA4B,CACpF,CAAC;AACN,CAAC,CAAC"}

package/dist/ciOutputs.d.ts

@@ -0,0 +1,2 @@
+export declare const ciOutputs: (root: string) => Record<string, string>;
+//# sourceMappingURL=ciOutputs.d.ts.map

package/dist/ciOutputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciOutputs.d.ts","sourceRoot":"","sources":["../src/ciOutputs.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,SAAS,GAAI,MAAM,MAAM,KAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAuC7D,CAAC"}

package/dist/ciOutputs.js

@@ -0,0 +1,31 @@
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { terraformConfigSchema } from "./schemas.js";
+import { validateConfig } from "./validateConfig.js";
+export const ciOutputs = (root) => {
+    const input = JSON.parse(readFileSync(join(root, ".arcnet/project.json"), "utf8"));
+    if (z.object({ mode: z.string().optional() }).parse(input).mode === "vercel") {
+        const c = validateConfig(input, root);
+        return {
+            approved: String(c.approved &&
+                Object.values(c.sites).every((s) => s.mode === "existing")),
+        };
+    }
+    const c = terraformConfigSchema.parse(input);
+    const n = z
+        .object({ region: z.string().regex(/^[a-z]+-[a-z]+[0-9]$/) })
+        .parse(parse(readFileSync(join(root, ".arcnet/network.yaml"), "utf8")));
+    if (c.approved &&
+        (!/^projects\/\d+\/locations\/global\/workloadIdentityPools\/github\/providers\/github-actions$/.test(c.workloadIdentityProvider) ||
+            !/^arc-deploy@[a-z][a-z0-9-]+\.iam\.gserviceaccount\.com$/.test(c.serviceAccount)))
+        throw new Error("Complete WIF configuration before approval.");
+    return {
+        approved: String(c.approved),
+        provider: c.approved ? c.workloadIdentityProvider : "",
+        account: c.approved ? c.serviceAccount : "",
+        registry: `${n.region}-docker.pkg.dev`,
+    };
+};
+//# sourceMappingURL=ciOutputs.js.map

package/dist/ciOutputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciOutputs.js","sourceRoot":"","sources":["../src/ciOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,IAAY,EAA0B,EAAE;IAChE,MAAM,KAAK,GAAY,IAAI,CAAC,KAAK,CAC/B,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CACzD,CAAC;IAEF,IACE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,QAAQ,EACxE,CAAC;QACD,MAAM,CAAC,GAAG,cAAc,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACtC,OAAO;YACL,QAAQ,EAAE,MAAM,CACd,CAAC,CAAC,QAAQ;gBACR,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAC7D;SACF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,CAAC,GAAG,CAAC;SACR,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,sBAAsB,CAAC,EAAE,CAAC;SAC5D,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAE1E,IACE,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,8FAA8F,CAAC,IAAI,CACnG,CAAC,CAAC,wBAAwB,CAC3B;YACC,CAAC,yDAAyD,CAAC,IAAI,CAC7D,CAAC,CAAC,cAAc,CACjB,CAAC;QAEJ,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,EAAE;QACtD,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE;QAC3C,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,iBAAiB;KACvC,CAAC;AACJ,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,9 @@
+#!/usr/bin/env node
+import { createCli } from "./createCli.js";
+await createCli()
+    .parseAsync()
+    .catch((error) => {
+    process.stderr.write(`ArcNet: ${error instanceof Error ? error.message : "Command failed"}\n`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,MAAM,SAAS,EAAE;KACd,UAAU,EAAE;KACZ,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;IACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,WAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,IAAI,CACzE,CAAC;IAEF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/createCli.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const createCli: () => Command;
+//# sourceMappingURL=createCli.d.ts.map

package/dist/createCli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCli.d.ts","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,eAAO,MAAM,SAAS,eAiHrB,CAAC"}

package/dist/createCli.js

@@ -0,0 +1,90 @@
+import { Command } from "commander";
+import { appendFileSync, readFileSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { ciOutputs } from "./ciOutputs.js";
+import { createSetupCommand } from "./createSetupCommand.js";
+import { packageVersion } from "./packageInfo.js";
+import { renderResult } from "./renderResult.js";
+import { runTerraform } from "./runTerraform.js";
+import { runVercel } from "./runVercel.js";
+import { setup } from "./setup.js";
+import { createSecretsCommands } from "./secrets/createSecretsCommands.js";
+import { withDeploymentSecrets } from "./secrets/withDeploymentSecrets.js";
+export const createCli = () => {
+    const cli = new Command("arcnet")
+        .description("Install and deploy ArcNet projects.")
+        .version(packageVersion)
+        .option("--root <directory>", "Target project root", process.cwd())
+        .option("--json", "Render one JSON result")
+        .option("--jsonl", "Render structured completion events")
+        .option("--noninteractive", "Run without prompts (all commands are noninteractive)");
+    cli.hook("preAction", () => {
+        if (cli.opts().json && cli.opts().jsonl)
+            throw new Error("Choose either --json or --jsonl.");
+    });
+    const output = (result) => {
+        process.stdout.write(renderResult(result, cli.opts()) + "\n");
+    };
+    createSecretsCommands(cli, output);
+    cli
+        .command("version")
+        .description("Show the installed package version.")
+        .action(() => output({ version: packageVersion }));
+    const install = createSetupCommand();
+    install.action(() => output({
+        ...setup(install.args.concat(install.options.flatMap((option) => {
+            const key = option.attributeName();
+            if (install.getOptionValueSource(key) !== "cli")
+                return [];
+            const value = install.opts()[key];
+            return value === true
+                ? [option.long]
+                : [option.long, String(value)];
+        })), realpathSync(cli.opts().root)),
+    }));
+    cli.addCommand(install);
+    for (const [name, description] of Object.entries({
+        check: "Validate project configuration offline.",
+        plan: "Plan deployment (Terraform contacts providers; static Vercel stays offline).",
+        deploy: "Deploy the approved project.",
+        preview: "Deploy static Vercel sites to preview.",
+        inspect: "Verify static Vercel project identities remotely.",
+        create: "Create one explicitly approved Vercel project.",
+    })) {
+        const command = cli.command(name).description(description);
+        if (name === "create")
+            command.argument("<site>", "Configured site name");
+        command.action(async (site) => {
+            const root = realpathSync(cli.opts().root);
+            const mode = z
+                .object({ mode: z.string().optional() })
+                .parse(JSON.parse(readFileSync(join(root, ".arcnet/project.json"), "utf8"))).mode;
+            const machine = Boolean(cli.opts().json || cli.opts().jsonl);
+            const execute = async () => {
+                if (mode === "vercel")
+                    return runVercel(name, root, typeof site === "string" ? site : undefined, machine);
+                if (name === "check" || name === "plan" || name === "deploy")
+                    return runTerraform(name, root, machine);
+                throw new Error(`${name} is only supported for static Vercel references.`);
+            };
+            output(await (name === "check" || (name === "plan" && mode === "vercel")
+                ? execute()
+                : withDeploymentSecrets(root, mode, execute)));
+        });
+    }
+    cli
+        .command("ci")
+        .description("Validate deployment identity and write GitHub Actions outputs.")
+        .action(() => {
+        const outputs = ciOutputs(realpathSync(cli.opts().root));
+        if (!process.env.GITHUB_OUTPUT)
+            throw new Error("GITHUB_OUTPUT is required for the ci command.");
+        appendFileSync(process.env.GITHUB_OUTPUT, Object.entries(outputs)
+            .map(([key, value]) => `${key}=${value}\n`)
+            .join(""));
+        output(outputs);
+    });
+    return cli;
+};
+//# sourceMappingURL=createCli.js.map

package/dist/createCli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createCli.js","sourceRoot":"","sources":["../src/createCli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,oCAAoC,CAAC;AAE3E,MAAM,CAAC,MAAM,SAAS,GAAG,GAAG,EAAE;IAC5B,MAAM,GAAG,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;SAC9B,WAAW,CAAC,qCAAqC,CAAC;SAClD,OAAO,CAAC,cAAc,CAAC;SACvB,MAAM,CAAC,oBAAoB,EAAE,qBAAqB,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAClE,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC;SAC1C,MAAM,CAAC,SAAS,EAAE,qCAAqC,CAAC;SACxD,MAAM,CACL,kBAAkB,EAClB,uDAAuD,CACxD,CAAC;IAEJ,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;QACzB,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK;YACrC,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,CAAC,MAAe,EAAE,EAAE;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAChE,CAAC,CAAC;IAEF,qBAAqB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAEnC,GAAG;SACA,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;IACrC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC;QACL,GAAG,KAAK,CACN,OAAO,CAAC,IAAI,CAAC,MAAM,CACjB,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YACjC,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,oBAAoB,CAAC,GAAG,CAAC,KAAK,KAAK;gBAAE,OAAO,EAAE,CAAC;YAC3D,MAAM,KAAK,GAAY,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC;YAC3C,OAAO,KAAK,KAAK,IAAI;gBACnB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,CAAC;gBAChB,CAAC,CAAC,CAAC,MAAM,CAAC,IAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC,CAAC,CACH,EACD,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAC9B;KACF,CAAC,CACH,CAAC;IAEF,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAExB,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAC/C,KAAK,EAAE,yCAAyC;QAChD,IAAI,EAAE,8EAA8E;QACpF,MAAM,EAAE,8BAA8B;QACtC,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,mDAAmD;QAC5D,MAAM,EAAE,gDAAgD;KACzD,CAAC,EAAE,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,QAAQ;YAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC;QAC1E,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,IAAa,EAAE,EAAE;YACrC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;YAE3C,MAAM,IAAI,GAAG,CAAC;iBACX,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC;iBACvC,KAAK,CACJ,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC,CACrE,CAAC,IAAI,CAAC;YAET,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC;YAE7D,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;gBACzB,IAAI,IAAI,KAAK,QAAQ;oBACnB,OAAO,SAAS,CACd,IAAI,EACJ,IAAI,EACJ,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAC3C,OAAO,CACR,CAAC;gBACJ,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;oBAC1D,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;gBAC3C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,kDAAkD,CAC1D,CAAC;YACJ,CAAC,CAAC;YAEF,MAAM,CACJ,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,CAAC;gBAC/D,CAAC,CAAC,OAAO,EAAE;gBACX,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAChD,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,GAAG;SACA,OAAO,CAAC,IAAI,CAAC;SACb,WAAW,CACV,gEAAgE,CACjE;SACA,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa;YAC5B,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,cAAc,CACZ,OAAO,CAAC,GAAG,CAAC,aAAa,EACzB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;aACpB,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,IAAI,CAAC;aAC1C,IAAI,CAAC,EAAE,CAAC,CACZ,CAAC;QAEF,MAAM,CAAC,OAAO,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,OAAO,GAAG,CAAC;AACb,CAAC,CAAC"}

package/dist/createProject.d.ts

@@ -0,0 +1,26 @@
+import type { VercelConfig, VercelRequest } from "./schemas.js";
+export declare const createProject: (config: VercelConfig, name: string, request: VercelRequest) => Promise<{
+    repository: string;
+    account: {
+        type: "team" | "personal";
+        id: string;
+    };
+    sites: Record<string, {
+        mode: "existing" | "new";
+        projectName: string;
+        build: string[];
+        output: string;
+        outputConfig: {
+            version: 3;
+            routes?: unknown[] | undefined;
+            overrides?: Record<string, unknown> | undefined;
+        };
+        projectId?: string | undefined;
+        creationApproved?: boolean | undefined;
+    }>;
+    version: 1;
+    mode: "vercel";
+    slug: string;
+    approved: boolean;
+}>;
+//# sourceMappingURL=createProject.d.ts.map

package/dist/createProject.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createProject.d.ts","sourceRoot":"","sources":["../src/createProject.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,eAAO,MAAM,aAAa,GACxB,QAAQ,YAAY,EACpB,MAAM,MAAM,EACZ,SAAS,aAAa;;;;;;;;;;;;;;;;;;;;;;;EA0DvB,CAAC"}

package/dist/createProject.js

@@ -0,0 +1,35 @@
+import { checkIdentity } from "./checkIdentity.js";
+import { fail } from "./fail.js";
+export const createProject = async (config, name, request) => {
+    const site = config.sites[name];
+    if (!site)
+        fail("Choose a configured site.");
+    if (site.mode === "existing") {
+        checkIdentity(await request("GET", `/v9/projects/${site.projectId}`, config.account), site, config.account);
+        return config;
+    }
+    if (site.creationApproved !== true)
+        fail("Project creation disabled. Obtain explicit target/cost approval and set creationApproved=true for this site.");
+    if (config.account.type === "personal") {
+        const who = await request("GET", "/v2/user", config.account);
+        if (who?.user?.id !== config.account.id)
+            fail("Token personal account does not match configured account; no project created.");
+    }
+    if (await request("GET", `/v9/projects/${encodeURIComponent(site.projectName)}`, config.account))
+        fail(`Project name ${site.projectName} already exists. Set an explicit existing reference after verifying its ID; no duplicate project was created.`);
+    const created = await request("POST", "/v11/projects", config.account, {
+        name: site.projectName,
+        framework: null,
+    });
+    if (!created ||
+        !/^prj_[A-Za-z0-9]+$/.test(created.id ?? "") ||
+        created.accountId !== config.account.id ||
+        created.name !== site.projectName)
+        fail("Creation response identity mismatch. Inspect the account before retrying.");
+    const next = structuredClone(config);
+    next.approved = false;
+    next.sites[name] = { ...site, mode: "existing", projectId: created.id };
+    delete next.sites[name].creationApproved;
+    return next;
+};
+//# sourceMappingURL=createProject.js.map

package/dist/createProject.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createProject.js","sourceRoot":"","sources":["../src/createProject.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAAoB,EACpB,IAAY,EACZ,OAAsB,EACtB,EAAE;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAE7C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QAC7B,aAAa,CACX,MAAM,OAAO,CAAC,KAAK,EAAE,gBAAgB,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EACtE,IAAI,EACJ,MAAM,CAAC,OAAO,CACf,CAAC;QAEF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI;QAChC,IAAI,CACF,8GAA8G,CAC/G,CAAC;IAEJ,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE;YACrC,IAAI,CACF,+EAA+E,CAChF,CAAC;IACN,CAAC;IAED,IACE,MAAM,OAAO,CACX,KAAK,EACL,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,EACtD,MAAM,CAAC,OAAO,CACf;QAED,IAAI,CACF,gBAAgB,IAAI,CAAC,WAAW,+GAA+G,CAChJ,CAAC;IAEJ,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,MAAM,CAAC,OAAO,EAAE;QACrE,IAAI,EAAE,IAAI,CAAC,WAAW;QACtB,SAAS,EAAE,IAAI;KAChB,CAAC,CAAC;IAEH,IACE,CAAC,OAAO;QACR,CAAC,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC;QAC5C,OAAO,CAAC,SAAS,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE;QACvC,OAAO,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW;QAEjC,IAAI,CACF,2EAA2E,CAC5E,CAAC;IACJ,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAG,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,gBAAgB,CAAC;IAC1C,OAAO,IAAI,CAAC;AACd,CAAC,CAAC"}

package/dist/createSetupCommand.d.ts

@@ -0,0 +1,3 @@
+import { Command } from "commander";
+export declare const createSetupCommand: () => Command;
+//# sourceMappingURL=createSetupCommand.d.ts.map

package/dist/createSetupCommand.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSetupCommand.d.ts","sourceRoot":"","sources":["../src/createSetupCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,eAAO,MAAM,kBAAkB,eAcgC,CAAC"}

package/dist/createSetupCommand.js

@@ -0,0 +1,11 @@
+import { Command } from "commander";
+export const createSetupCommand = () => new Command("setup")
+    .description("Add ArcNet configuration and workflow; pin the CLI in the project manifest.")
+    .argument("<slug>", "Project slug matching zap.yaml")
+    .option("--dry-run", "Report generated files without writing")
+    .option("--service <name>", "Default container service", "backend")
+    .option("--dockerfile <path>", "Container Dockerfile", ".arcnet/Dockerfile")
+    .option("--repository <owner/repo>", "GitHub repository (defaults to origin)")
+    .option("--services <path>", "Explicit service selection JSON")
+    .option("--vercel <path>", "Static Vercel references JSON");
+//# sourceMappingURL=createSetupCommand.js.map

package/dist/createSetupCommand.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createSetupCommand.js","sourceRoot":"","sources":["../src/createSetupCommand.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAAG,EAAE,CACrC,IAAI,OAAO,CAAC,OAAO,CAAC;KACjB,WAAW,CACV,6EAA6E,CAC9E;KACA,QAAQ,CAAC,QAAQ,EAAE,gCAAgC,CAAC;KACpD,MAAM,CAAC,WAAW,EAAE,wCAAwC,CAAC;KAC7D,MAAM,CAAC,kBAAkB,EAAE,2BAA2B,EAAE,SAAS,CAAC;KAClE,MAAM,CAAC,qBAAqB,EAAE,sBAAsB,EAAE,oBAAoB,CAAC;KAC3E,MAAM,CACL,2BAA2B,EAC3B,wCAAwC,CACzC;KACA,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;KAC9D,MAAM,CAAC,iBAAiB,EAAE,+BAA+B,CAAC,CAAC"}

package/dist/deploy.d.ts

@@ -0,0 +1,3 @@
+import type { RunProcess, VercelConfig, VercelRequest } from "./schemas.js";
+export declare const deploy: (config: VercelConfig, root: string, request: VercelRequest, run: RunProcess, environment: NodeJS.ProcessEnv, target?: string) => Promise<void>;
+//# sourceMappingURL=deploy.d.ts.map

package/dist/deploy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,UAAU,EACV,YAAY,EACZ,aAAa,EAEd,MAAM,cAAc,CAAC;AAItB,eAAO,MAAM,MAAM,GACjB,QAAQ,YAAY,EACpB,MAAM,MAAM,EACZ,SAAS,aAAa,EACtB,KAAK,UAAU,EACf,aAAa,MAAM,CAAC,UAAU,EAC9B,eAAqB,kBAoDtB,CAAC"}

package/dist/deploy.js

@@ -0,0 +1,47 @@
+import { rmSync } from "node:fs";
+import { fail } from "./fail.js";
+import { inspectReferences } from "./inspectReferences.js";
+import { stageSite } from "./stageSite.js";
+import { validateConfig } from "./validateConfig.js";
+export const deploy = async (config, root, request, run, environment, target = "production") => {
+    validateConfig(config, root);
+    if (config.approved !== true)
+        fail("Deployment disabled. Review account, project references, routing and production-trigger ownership before setting approved=true.");
+    if (!["production", "preview"].includes(target))
+        fail("Target must be production or preview.");
+    if (environment.GITHUB_ACTIONS === "true" &&
+        (environment.GITHUB_REPOSITORY !== config.repository ||
+            environment.GITHUB_REF !== "refs/heads/main"))
+        fail("CI deployment is restricted to the configured repository main branch.");
+    await inspectReferences(config, request); // Check every identity before building or uploading any site.
+    const stages = [];
+    try {
+        for (const site of Object.values(config.sites)) {
+            const buildEnv = Object.fromEntries(Object.entries(environment).filter(([k]) => !k.startsWith("VERCEL_")));
+            await run(site.build[0], site.build.slice(1), root, buildEnv);
+            stages.push([site, stageSite(root, site, config.account)]);
+        }
+        for (const [site, stage] of stages) {
+            const args = [
+                "--yes",
+                "vercel@63.1.2",
+                "deploy",
+                "--prebuilt",
+                "--yes",
+                ...(target === "production" ? ["--prod"] : []),
+                "--token",
+                environment.VERCEL_TOKEN,
+            ];
+            await run("npx", args, stage, {
+                ...environment,
+                VERCEL_PROJECT_ID: site.projectId,
+                VERCEL_ORG_ID: config.account.id,
+            });
+        }
+    }
+    finally {
+        for (const [, stage] of stages)
+            rmSync(stage, { recursive: true, force: true });
+    }
+};
+//# sourceMappingURL=deploy.js.map

package/dist/deploy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../src/deploy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAO3D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErD,MAAM,CAAC,MAAM,MAAM,GAAG,KAAK,EACzB,MAAoB,EACpB,IAAY,EACZ,OAAsB,EACtB,GAAe,EACf,WAA8B,EAC9B,MAAM,GAAG,YAAY,EACrB,EAAE;IACF,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC7B,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;QAC1B,IAAI,CACF,iIAAiI,CAClI,CAAC;IACJ,IAAI,CAAC,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAC7C,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAChD,IACE,WAAW,CAAC,cAAc,KAAK,MAAM;QACrC,CAAC,WAAW,CAAC,iBAAiB,KAAK,MAAM,CAAC,UAAU;YAClD,WAAW,CAAC,UAAU,KAAK,iBAAiB,CAAC;QAE/C,IAAI,CACF,uEAAuE,CACxE,CAAC;IACJ,MAAM,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,8DAA8D;IACxG,MAAM,MAAM,GAAgC,EAAE,CAAC;IAE/C,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CACjC,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CACtE,CAAC;YAEF,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAC/D,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;YACnC,MAAM,IAAI,GAAG;gBACX,OAAO;gBACP,eAAe;gBACf,QAAQ;gBACR,YAAY;gBACZ,OAAO;gBACP,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9C,SAAS;gBACT,WAAW,CAAC,YAAa;aAC1B,CAAC;YAEF,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC5B,GAAG,WAAW;gBACd,iBAAiB,EAAE,IAAI,CAAC,SAAS;gBACjC,aAAa,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM;YAC5B,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC"}

package/dist/fail.d.ts

@@ -0,0 +1,2 @@
+export declare const fail: (message: string) => never;
+//# sourceMappingURL=fail.d.ts.map

package/dist/fail.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail.d.ts","sourceRoot":"","sources":["../src/fail.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,KAEvC,CAAC"}

package/dist/fail.js

@@ -0,0 +1,4 @@
+export const fail = (message) => {
+    throw new Error(message);
+};
+//# sourceMappingURL=fail.js.map

package/dist/fail.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fail.js","sourceRoot":"","sources":["../src/fail.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,IAAI,GAA+B,CAAC,OAAO,EAAE,EAAE;IAC1D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;AAC3B,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { createCli } from "./createCli.js";
+export { setup } from "./setup.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export { createCli } from "./createCli.js";
+export { setup } from "./setup.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC"}

package/dist/inspectReferences.d.ts

@@ -0,0 +1,3 @@
+import type { VercelConfig, VercelRequest } from "./schemas.js";
+export declare const inspectReferences: (config: VercelConfig, request: VercelRequest) => Promise<void>;
+//# sourceMappingURL=inspectReferences.d.ts.map

package/dist/inspectReferences.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspectReferences.d.ts","sourceRoot":"","sources":["../src/inspectReferences.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEhE,eAAO,MAAM,iBAAiB,GAC5B,QAAQ,YAAY,EACpB,SAAS,aAAa,kBAavB,CAAC"}

package/dist/inspectReferences.js

@@ -0,0 +1,10 @@
+import { checkIdentity } from "./checkIdentity.js";
+import { fail } from "./fail.js";
+export const inspectReferences = async (config, request) => {
+    for (const site of Object.values(config.sites)) {
+        if (site.mode !== "existing")
+            fail(`Project ${site.projectName} is new. Create it explicitly, review and commit the returned reference before deployment.`);
+        checkIdentity(await request("GET", `/v9/projects/${site.projectId}`, config.account), site, config.account);
+    }
+};
+//# sourceMappingURL=inspectReferences.js.map

package/dist/inspectReferences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspectReferences.js","sourceRoot":"","sources":["../src/inspectReferences.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EACpC,MAAoB,EACpB,OAAsB,EACtB,EAAE;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU;YAC1B,IAAI,CACF,WAAW,IAAI,CAAC,WAAW,4FAA4F,CACxH,CAAC;QACJ,aAAa,CACX,MAAM,OAAO,CAAC,KAAK,EAAE,gBAAgB,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EACtE,IAAI,EACJ,MAAM,CAAC,OAAO,CACf,CAAC;IACJ,CAAC;AACH,CAAC,CAAC"}

package/dist/inspectStaticTree.d.ts

@@ -0,0 +1,2 @@
+export declare const inspectStaticTree: (path: string) => void;
+//# sourceMappingURL=inspectStaticTree.d.ts.map

package/dist/inspectStaticTree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inspectStaticTree.d.ts","sourceRoot":"","sources":["../src/inspectStaticTree.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,iBAAiB,GAAI,MAAM,MAAM,SAc7C,CAAC"}

package/dist/inspectStaticTree.js

@@ -0,0 +1,17 @@
+import { lstatSync, readdirSync } from "node:fs";
+import { join } from "node:path";
+import { fail } from "./fail.js";
+export const inspectStaticTree = (path) => {
+    for (const name of readdirSync(path)) {
+        const p = join(path, name), stat = lstatSync(p);
+        if (stat.isSymbolicLink() ||
+            [".git", ".env", "node_modules"].includes(name) ||
+            name.startsWith(".env."))
+            fail(`Refusing unsafe static artifact entry: ${name}`);
+        if (stat.isDirectory())
+            inspectStaticTree(p);
+        else if (!stat.isFile())
+            fail("Static output contains a non-regular file.");
+    }
+};
+//# sourceMappingURL=inspectStaticTree.js.map