@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/dist/secrets/writeSecretsWorkflow.js

@@ -0,0 +1,60 @@
+import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { stringify } from "yaml";
+import { safeTargetPath } from "../safeTargetPath.js";
+import { wireSecretsWorkflows } from "./wireSecretsWorkflows.js";
+export const writeSecretsWorkflow = (config, root, configFile) => {
+    const path = safeTargetPath(root, ".github/workflows/validate-arcnet-secrets.yaml");
+    const marker = "# Generated by arcnet secrets; configure sources in .arcnet/secrets.json.\n";
+    if (existsSync(path) && !readFileSync(path, "utf8").startsWith(marker))
+        throw new Error("Existing validate-arcnet-secrets.yaml is not ArcNet-managed; move it before continuing.");
+    if (configFile !== ".arcnet/secrets.json")
+        throw new Error("Generated CI requires the standard .arcnet/secrets.json location.");
+    mkdirSync(dirname(path), { recursive: true });
+    const env = Object.fromEntries(config.sources
+        .flatMap((source) => [
+        source.keyEnv,
+        ...(!source.snapshot && source.tokenEnv ? [source.tokenEnv] : []),
+    ])
+        .map((key) => [key, `\u0024{{ secrets.${key} }}`]));
+    writeFileSync(path, marker +
+        stringify({
+            name: "Validate ArcNet secrets",
+            on: {
+                workflow_dispatch: {},
+                push: {
+                    branches: ["main"],
+                    paths: [
+                        ".arcnet/**",
+                        ".github/workflows/validate-arcnet-secrets.yaml",
+                        "package.json",
+                        "pnpm-lock.yaml",
+                    ],
+                },
+            },
+            permissions: { contents: "read" },
+            jobs: {
+                validate: {
+                    if: `github.repository == '${config.repository}' && github.ref == 'refs/heads/main'`,
+                    "runs-on": "ubuntu-latest",
+                    "timeout-minutes": 10,
+                    steps: [
+                        {
+                            uses: "actions/checkout@v4",
+                            with: { "persist-credentials": false },
+                        },
+                        { uses: "pnpm/action-setup@v4" },
+                        { uses: "actions/setup-node@v4", with: { "node-version": 22 } },
+                        { run: "pnpm install --frozen-lockfile --ignore-scripts" },
+                        {
+                            name: "Decrypt, merge and validate selected keys",
+                            run: "pnpm exec arcnet env check",
+                            env,
+                        },
+                    ],
+                },
+            },
+        }));
+    wireSecretsWorkflows(dirname(path), env);
+};
+//# sourceMappingURL=writeSecretsWorkflow.js.map

package/dist/secrets/writeSecretsWorkflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"writeSecretsWorkflow.js","sourceRoot":"","sources":["../../src/secrets/writeSecretsWorkflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAClC,MAAqB,EACrB,IAAY,EACZ,UAAkB,EAClB,EAAE;IACF,MAAM,IAAI,GAAG,cAAc,CACzB,IAAI,EACJ,gDAAgD,CACjD,CAAC;IAEF,MAAM,MAAM,GACV,6EAA6E,CAAC;IAEhF,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,IAAI,UAAU,KAAK,sBAAsB;QACvC,MAAM,IAAI,KAAK,CACb,mEAAmE,CACpE,CAAC;IACJ,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO;SACX,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM;QACb,GAAG,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;SACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,oBAAoB,GAAG,KAAK,CAAC,CAAC,CACrD,CAAC;IAEF,aAAa,CACX,IAAI,EACJ,MAAM;QACJ,SAAS,CAAC;YACR,IAAI,EAAE,yBAAyB;YAC/B,EAAE,EAAE;gBACF,iBAAiB,EAAE,EAAE;gBACrB,IAAI,EAAE;oBACJ,QAAQ,EAAE,CAAC,MAAM,CAAC;oBAClB,KAAK,EAAE;wBACL,YAAY;wBACZ,gDAAgD;wBAChD,cAAc;wBACd,gBAAgB;qBACjB;iBACF;aACF;YACD,WAAW,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YACjC,IAAI,EAAE;gBACJ,QAAQ,EAAE;oBACR,EAAE,EAAE,yBAAyB,MAAM,CAAC,UAAU,sCAAsC;oBACpF,SAAS,EAAE,eAAe;oBAC1B,iBAAiB,EAAE,EAAE;oBACrB,KAAK,EAAE;wBACL;4BACE,IAAI,EAAE,qBAAqB;4BAC3B,IAAI,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;yBACvC;wBACD,EAAE,IAAI,EAAE,sBAAsB,EAAE;wBAChC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE;wBAC/D,EAAE,GAAG,EAAE,iDAAiD,EAAE;wBAC1D;4BACE,IAAI,EAAE,2CAA2C;4BACjD,GAAG,EAAE,4BAA4B;4BACjC,GAAG;yBACJ;qBACF;iBACF;aACF;SACF,CAAC,CACL,CAAC;IAEF,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC,CAAC"}

package/dist/selectNetwork.d.ts

@@ -0,0 +1,26 @@
+import { type ServiceDeploy } from "@mp-lb/zapper/dist/arc/schemas.js";
+export declare const selectNetwork: (slug: string, selection: Record<string, ServiceDeploy> | undefined, safe: (name: string) => string) => {
+    network: {
+        [x: string]: unknown;
+        name: string;
+        dns: {
+            zone: string;
+        };
+        env: {
+            resolver: string;
+            "public-file": string;
+        };
+        providers: Record<string, {
+            source: string;
+            version?: string | undefined;
+            config?: Record<string, unknown> | undefined;
+        }>;
+        "module-defaults": Record<string, Record<string, unknown>>;
+        "gcp-project": string;
+        backend?: Record<string, Record<string, unknown>> | undefined;
+        registry?: string | undefined;
+        modules?: string | undefined;
+    };
+    gcpProject: string;
+};
+//# sourceMappingURL=selectNetwork.d.ts.map

package/dist/selectNetwork.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectNetwork.d.ts","sourceRoot":"","sources":["../src/selectNetwork.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,mCAAmC,CAAC;AAU3C,eAAO,MAAM,aAAa,GACxB,MAAM,MAAM,EACZ,WAAW,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,SAAS,EACpD,MAAM,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;CAwD/B,CAAC"}

package/dist/selectNetwork.js

@@ -0,0 +1,48 @@
+import { networkConfigSchema, } from "@mp-lb/zapper/dist/arc/schemas.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { fail } from "./fail.js";
+import { packageRoot } from "./packageInfo.js";
+const networkSchema = networkConfigSchema.extend({ "gcp-project": z.string() });
+const read = (path) => readFileSync(path, "utf8");
+export const selectNetwork = (slug, selection, safe) => {
+    const network = networkSchema.parse(parse(read(existsSync(safe("arcnet.network.yaml"))
+        ? safe("arcnet.network.yaml")
+        : join(packageRoot, "templates/network.yaml"))));
+    const selectedModules = selection
+        ? Object.values(selection).map((s) => s.module)
+        : ["cloud-run-web"];
+    const providerMap = {
+        "cloud-run-web": ["google", "cloudflare"],
+        "gce-worker": ["google"],
+        "vercel-static": ["vercel", "cloudflare"],
+        "shared-mongo-atlas": ["mongodbatlas"],
+        "upstash-redis": ["upstash"],
+        "aws-s3": ["aws"],
+    };
+    const providers = new Set([
+        "google",
+        ...selectedModules.flatMap((m) => providerMap[m] ?? []),
+    ]);
+    network.providers = Object.fromEntries([...providers].map((k) => {
+        const provider = network.providers[k];
+        if (!provider)
+            fail(`Network is missing provider ${k}.`);
+        return [k, provider];
+    }));
+    const defaults = new Set([
+        "github-ci",
+        "gcp-project",
+        "project-base",
+        ...selectedModules,
+    ]);
+    network["module-defaults"] = Object.fromEntries(Object.entries(network["module-defaults"]).filter(([k]) => defaults.has(k)));
+    network.env = { resolver: "false", "public-file": ".arcnet/unused.env" };
+    const gcpProject = network["gcp-project"]?.replaceAll("{slug}", slug);
+    if (!/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(gcpProject ?? ""))
+        fail("Network gcp-project must resolve to a valid 6–30 character project ID using {slug}.");
+    return { network, gcpProject };
+};
+//# sourceMappingURL=selectNetwork.js.map

package/dist/selectNetwork.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"selectNetwork.js","sourceRoot":"","sources":["../src/selectNetwork.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAEpB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,MAAM,aAAa,GAAG,mBAAmB,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAChF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAE1D,MAAM,CAAC,MAAM,aAAa,GAAG,CAC3B,IAAY,EACZ,SAAoD,EACpD,IAA8B,EAC9B,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CACjC,KAAK,CACH,IAAI,CACF,UAAU,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;QAC7B,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAChD,CACF,CACF,CAAC;IAEF,MAAM,eAAe,GAAG,SAAS;QAC/B,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAC/C,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC;IAEtB,MAAM,WAAW,GAA6B;QAC5C,eAAe,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QACzC,YAAY,EAAE,CAAC,QAAQ,CAAC;QACxB,eAAe,EAAE,CAAC,QAAQ,EAAE,YAAY,CAAC;QACzC,oBAAoB,EAAE,CAAC,cAAc,CAAC;QACtC,eAAe,EAAE,CAAC,SAAS,CAAC;QAC5B,QAAQ,EAAE,CAAC,KAAK,CAAC;KAClB,CAAC;IAEF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,QAAQ;QACR,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;KACxD,CAAC,CAAC;IAEH,OAAO,CAAC,SAAS,GAAG,MAAM,CAAC,WAAW,CACpC,CAAC,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ;YAAE,IAAI,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC;QACzD,OAAO,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACvB,CAAC,CAAC,CACH,CAAC;IAEF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC;QACvB,WAAW;QACX,aAAa;QACb,cAAc;QACd,GAAG,eAAe;KACnB,CAAC,CAAC;IAEH,OAAO,CAAC,iBAAiB,CAAC,GAAG,MAAM,CAAC,WAAW,CAC7C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC5E,CAAC;IAEF,OAAO,CAAC,GAAG,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,CAAC;IACzE,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACtE,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAC1D,IAAI,CACF,qFAAqF,CACtF,CAAC;IACJ,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC,CAAC"}

package/dist/setup.d.ts

@@ -0,0 +1,2 @@
+export declare const setup: (args: string[], root?: string) => import("./setupReport.js").SetupReport;
+//# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AA2BA,eAAO,MAAM,KAAK,GAAI,MAAM,MAAM,EAAE,EAAE,aAAoB,2CAyPzD,CAAC"}

package/dist/setup.js

@@ -0,0 +1,192 @@
+import { setupReport } from "./setupReport.js";
+import { existsSync, lstatSync, mkdirSync, readFileSync, realpathSync, writeFileSync, } from "node:fs";
+import { dirname, join } from "node:path";
+import { parseDocument, stringify } from "yaml";
+import { z } from "zod";
+import { addDependency, hasDependency } from "./addDependency.js";
+import { fail } from "./fail.js";
+import { packageRoot } from "./packageInfo.js";
+import { parseSetupInput } from "./parseSetupInput.js";
+import { readSelection } from "./readSelection.js";
+import { resolveRepository } from "./resolveRepository.js";
+import { safeTargetPath } from "./safeTargetPath.js";
+import { selectNetwork } from "./selectNetwork.js";
+import { setupVercel } from "./setupVercel.js";
+const home = packageRoot;
+const read = (p) => readFileSync(p, "utf8");
+const json = (value) => JSON.stringify(value, null, 2) + "\n";
+export const setup = (args, root = process.cwd()) => {
+    const { slug, options, dry } = parseSetupInput(args);
+    root = realpathSync(root);
+    const safe = (name) => safeTargetPath(root, name);
+    if (!options.services) {
+        const inputs = [".arcnet/services.json", "arcnet.services.json"].filter((name) => existsSync(safe(name)));
+        if (inputs.length > 1)
+            fail("Both .arcnet/services.json and arcnet.services.json exist. Select one with --services.");
+        options.services = inputs[0];
+    }
+    if (!options["seen-dockerfile"] &&
+        !existsSync(safe(options.dockerfile)) &&
+        existsSync(safe("Dockerfile")))
+        options.dockerfile = "Dockerfile";
+    const zapPath = safe("zap.yaml");
+    if (!existsSync(zapPath))
+        fail("Run setup from a target repository containing zap.yaml.");
+    const doc = parseDocument(read(zapPath));
+    if (doc.errors.length)
+        fail("zap.yaml is invalid YAML; fix it before setup.");
+    const project = z
+        .object({
+        project: z.string(),
+        native: z.record(z.string(), z.unknown()).optional(),
+        docker: z.record(z.string(), z.unknown()).optional(),
+        containers: z.record(z.string(), z.unknown()).optional(),
+        deploy: z.unknown().optional(),
+    })
+        .parse(doc.toJS());
+    if (project.project !== slug)
+        fail(`Slug must equal zap.yaml project (${project.project}). No files changed.`);
+    if (!options.vercel) {
+        const inputs = [".arcnet/vercel.json", "arcnet.vercel.json"].filter((name) => existsSync(safe(name)));
+        if (inputs.length > 1)
+            fail("Both .arcnet/vercel.json and arcnet.vercel.json exist. Select one with --vercel.");
+        options.vercel = inputs[0];
+    }
+    if (options.vercel) {
+        if (options.services ||
+            options["seen-service"] ||
+            options["seen-dockerfile"] ||
+            options["seen-repository"])
+            fail("Vercel-only input cannot be combined with Terraform/service flags or a services.json input.");
+        if (!existsSync(safe("pnpm-lock.yaml")) ||
+            !existsSync(safe("package.json")))
+            fail("A target pnpm package.json and lockfile are required.");
+        const pm = JSON.parse(read(safe("package.json"))).packageManager;
+        if (!/^pnpm@\d+\.\d+\.\d+(?:\+sha\d+\.[a-f0-9]+)?$/.test(pm ?? ""))
+            fail("Pin packageManager to an exact pnpm version.");
+        return setupVercel({
+            root,
+            slug,
+            safe,
+            file: options.vercel,
+            dry,
+            hasDeploy: Boolean(project.deploy),
+        });
+    }
+    if (!/^[a-z][a-z0-9-]*$/.test(options.service) ||
+        ["gcp", "registry", "ci"].includes(options.service) ||
+        /myshop/i.test(`${options.service} ${options.dockerfile}`))
+        fail("Invalid or reserved service name; MyShop must remain local-only.");
+    if (!options.services &&
+        !Object.hasOwn(project.native ?? {}, options.service) &&
+        !Object.hasOwn(project.docker ?? {}, options.service) &&
+        !Object.hasOwn(project.containers ?? {}, options.service))
+        fail(`No local service named ${options.service} in zap.yaml.`);
+    if (!options.services &&
+        (!existsSync(safe(options.dockerfile)) ||
+            !lstatSync(safe(options.dockerfile)).isFile()))
+        fail(`Missing ${options.dockerfile}. Add and test a backend-only Dockerfile listening on PORT=8080 with GET /health; use --dockerfile for another path.`);
+    if (!existsSync(safe("pnpm-lock.yaml")) || !existsSync(safe("package.json")))
+        fail("A pnpm project with committed package.json and pnpm-lock.yaml is required.");
+    const packageManager = JSON.parse(read(safe("package.json"))).packageManager;
+    if (!/^pnpm@\d+\.\d+\.\d+(?:\+sha\d+\.[a-f0-9]+)?$/.test(packageManager ?? ""))
+        fail("package.json must pin an exact pnpm packageManager version for reproducible CI.");
+    const repository = resolveRepository(root, options.repository);
+    if (options.services &&
+        (options["seen-service"] || options["seen-dockerfile"]))
+        fail("--services cannot be combined with --service or --dockerfile.");
+    const selection = options.services
+        ? readSelection(options.services, safe)
+        : undefined;
+    const configPath = safe(".arcnet/project.json");
+    if (existsSync(configPath)) {
+        const old = JSON.parse(read(configPath));
+        if (old.slug !== slug ||
+            old.repository !== repository ||
+            old.service !== options.service ||
+            old.dockerfile !== options.dockerfile ||
+            JSON.stringify(old.selection) !== JSON.stringify(selection))
+            fail("Existing ArcNet setup differs. Edit/review its committed config; setup never overwrites it.");
+        const required = [
+            ".arcnet/network.yaml",
+            ".arcnet/.gitignore",
+            ".github/workflows/deploy-arc.yaml",
+        ];
+        if (!project.deploy ||
+            !hasDependency(root) ||
+            required.some((p) => !existsSync(safe(p))))
+            fail("Incomplete ArcNet installation. Restore missing files from Git before rerunning.");
+        return setupReport("already-configured", [], "Already configured; preserved all existing files and edits.");
+    }
+    if (project.deploy)
+        fail("Existing deploy block detected. Migrate it explicitly; no files changed.");
+    const { network, gcpProject } = selectNetwork(slug, selection, safe);
+    const config = {
+        version: 1,
+        slug,
+        repository,
+        service: options.service,
+        dockerfile: options.dockerfile,
+        selection,
+        services: selection ? Object.keys(selection) : [options.service],
+        approved: false,
+        workloadIdentityProvider: "",
+        serviceAccount: `arc-deploy@${gcpProject}.iam.gserviceaccount.com`,
+    };
+    const deployedSelection = selection && structuredClone(selection);
+    for (const block of Object.values(deployedSelection ?? {}))
+        if (block.module === "vercel-static")
+            block.module = "./node_modules/@mp-lb/arcnet/templates/vercel-static";
+    doc.set("deploy", {
+        project: {
+            gcp: { module: "gcp-project" },
+            registry: { module: "project-base", "depends-on": ["gcp"] },
+            ci: {
+                module: "github-ci",
+                "depends-on": ["gcp"],
+                params: { repository },
+            },
+        },
+        services: deployedSelection ?? {
+            [options.service]: {
+                module: "cloud-run-web",
+                domain: `${slug}-api.${network.dns.zone}`,
+                dockerfile: options.dockerfile,
+                env: [],
+                params: {
+                    port: 8080,
+                    "health-path": "/health",
+                    "min-instances": 0,
+                    "max-instances": 2,
+                },
+            },
+        },
+    });
+    const files = new Map([
+        [".arcnet/project.json", json(config)],
+        [".arcnet/network.yaml", stringify(network)],
+        [
+            ".arcnet/.gitignore",
+            "node_modules/\n.terraform/\n*.tfstate*\n*.tfplan\ncredentials.env\n",
+        ],
+        [
+            ".github/workflows/deploy-arc.yaml",
+            read(join(home, "templates/deploy-arc.yaml")),
+        ],
+    ]);
+    for (const name of files.keys())
+        if (existsSync(safe(name)))
+            fail(`Refusing to overwrite ${name}. No files changed.`);
+    const manifest = addDependency(safe("package.json"));
+    if (dry)
+        return setupReport("dry-run", [...files.keys(), "package.json", "zap.yaml"], `Dry run: would pin @mp-lb/arcnet in package.json and add deploy.services (${config.services.join(", ")}), ${[...files.keys()].join(", ")}. No files written; no cloud commands run.`);
+    // Validate every destination before writing; preserve unrelated files and YAML comments.
+    for (const [name, content] of files) {
+        mkdirSync(dirname(safe(name)), { recursive: true });
+        writeFileSync(safe(name), content, { flag: "wx" });
+    }
+    writeFileSync(zapPath, doc.toString());
+    writeFileSync(safe("package.json"), manifest);
+    return setupReport("installed", [...files.keys(), "package.json", "zap.yaml"], "ArcNet files generated. Deployment is disabled (approved=false). Review the StackForge ArcNet prerequisites, network REPLACE_ placeholders, Dockerfile, domain, env whitelist and Git diff. Install: pnpm install. Offline check: pnpm exec arcnet check. Only the selected services are included; no existing Vercel project is automatically adopted. MyShop stays local-only.");
+};
+//# sourceMappingURL=setup.js.map

package/dist/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAE/C,MAAM,IAAI,GAAG,WAAW,CAAC;AAEzB,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACpD,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAEvE,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,IAAc,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE;IAC5D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAE1D,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,uBAAuB,EAAE,sBAAsB,CAAC,CAAC,MAAM,CACrE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACnB,IAAI,CACF,wFAAwF,CACzF,CAAC;QACJ,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IAED,IACE,CAAC,OAAO,CAAC,iBAAiB,CAAC;QAC3B,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE9B,OAAO,CAAC,UAAU,GAAG,YAAY,CAAC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACtB,IAAI,CAAC,yDAAyD,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM;QAAE,IAAI,CAAC,gDAAgD,CAAC,CAAC;IAE9E,MAAM,OAAO,GAAG,CAAC;SACd,MAAM,CAAC;QACN,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;QACnB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QACpD,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QACpD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;QACxD,MAAM,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC;SACD,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAErB,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI;QAC1B,IAAI,CACF,qCAAqC,OAAO,CAAC,OAAO,sBAAsB,CAC3E,CAAC;IAEJ,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,qBAAqB,EAAE,oBAAoB,CAAC,CAAC,MAAM,CACjE,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACjC,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YACnB,IAAI,CACF,kFAAkF,CACnF,CAAC;QACJ,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IACE,OAAO,CAAC,QAAQ;YAChB,OAAO,CAAC,cAAc,CAAC;YACvB,OAAO,CAAC,iBAAiB,CAAC;YAC1B,OAAO,CAAC,iBAAiB,CAAC;YAE1B,IAAI,CACF,6FAA6F,CAC9F,CAAC;QACJ,IACE,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACnC,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAEjC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QAChE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;QACjE,IAAI,CAAC,8CAA8C,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;YAChE,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,OAAO,WAAW,CAAC;YACjB,IAAI;YACJ,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,OAAO,CAAC,MAAM;YACpB,GAAG;YACH,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,IACE,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1C,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;QACnD,SAAS,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAE1D,IAAI,CAAC,kEAAkE,CAAC,CAAC;IAC3E,IACE,CAAC,OAAO,CAAC,QAAQ;QACjB,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC;QACrD,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC;QACrD,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC;QAEzD,IAAI,CAAC,0BAA0B,OAAO,CAAC,OAAO,eAAe,CAAC,CAAC;IACjE,IACE,CAAC,OAAO,CAAC,QAAQ;QACjB,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;YACpC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QAEhD,IAAI,CACF,WAAW,OAAO,CAAC,UAAU,sHAAsH,CACpJ,CAAC;IACJ,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC1E,IAAI,CACF,4EAA4E,CAC7E,CAAC;IACJ,MAAM,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;IAC7E,IACE,CAAC,8CAA8C,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;QAE1E,IAAI,CACF,iFAAiF,CAClF,CAAC;IACJ,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,IACE,OAAO,CAAC,QAAQ;QAChB,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;QAEvD,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAExE,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ;QAChC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACvC,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,UAAU,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAEhD,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QACzC,IACE,GAAG,CAAC,IAAI,KAAK,IAAI;YACjB,GAAG,CAAC,UAAU,KAAK,UAAU;YAC7B,GAAG,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;YAC/B,GAAG,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;YACrC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC;YAE3D,IAAI,CACF,6FAA6F,CAC9F,CAAC;QAEJ,MAAM,QAAQ,GAAG;YACf,sBAAsB;YACtB,oBAAoB;YACpB,mCAAmC;SACpC,CAAC;QAEF,IACE,CAAC,OAAO,CAAC,MAAM;YACf,CAAC,aAAa,CAAC,IAAI,CAAC;YACpB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAE1C,IAAI,CACF,kFAAkF,CACnF,CAAC;QACJ,OAAO,WAAW,CAChB,oBAAoB,EACpB,EAAE,EACF,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,MAAM;QAChB,IAAI,CACF,0EAA0E,CAC3E,CAAC;IACJ,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,aAAa,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;IAErE,MAAM,MAAM,GAAG;QACb,OAAO,EAAE,CAAC;QACV,IAAI;QACJ,UAAU;QACV,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS;QACT,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAChE,QAAQ,EAAE,KAAK;QACf,wBAAwB,EAAE,EAAE;QAC5B,cAAc,EAAE,cAAc,UAAU,0BAA0B;KACnE,CAAC;IAEF,MAAM,iBAAiB,GAAG,SAAS,IAAI,eAAe,CAAC,SAAS,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;YAClC,KAAK,CAAC,MAAM,GAAG,sDAAsD,CAAC;IAC1E,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE;QAChB,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE;YAC9B,QAAQ,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,KAAK,CAAC,EAAE;YAC3D,EAAE,EAAE;gBACF,MAAM,EAAE,WAAW;gBACnB,YAAY,EAAE,CAAC,KAAK,CAAC;gBACrB,MAAM,EAAE,EAAE,UAAU,EAAE;aACvB;SACF;QACD,QAAQ,EAAE,iBAAiB,IAAI;YAC7B,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;gBACjB,MAAM,EAAE,eAAe;gBACvB,MAAM,EAAE,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;gBACzC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,GAAG,EAAE,EAAE;gBACP,MAAM,EAAE;oBACN,IAAI,EAAE,IAAI;oBACV,aAAa,EAAE,SAAS;oBACxB,eAAe,EAAE,CAAC;oBAClB,eAAe,EAAE,CAAC;iBACnB;aACF;SACF;KACF,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,sBAAsB,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;QAC5C;YACE,oBAAoB;YACpB,qEAAqE;SACtE;QACD;YACE,mCAAmC;YACnC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,2BAA2B,CAAC,CAAC;SAC9C;KACF,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG;QACL,OAAO,WAAW,CAChB,SAAS,EACT,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,EAC7C,6EAA6E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,4CAA4C,CACtL,CAAC;IAEJ,yFAAyF;IACzF,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvC,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,WAAW,CAChB,WAAW,EACX,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,EAC7C,kXAAkX,CACnX,CAAC;AACJ,CAAC,CAAC"}

package/dist/setupReport.d.ts

@@ -0,0 +1,8 @@
+export type SetupReport = {
+    operation: "setup";
+    status: "dry-run" | "installed" | "already-configured";
+    files: string[];
+    message: string;
+};
+export declare const setupReport: (status: SetupReport["status"], files: string[], message: string) => SetupReport;
+//# sourceMappingURL=setupReport.d.ts.map

package/dist/setupReport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupReport.d.ts","sourceRoot":"","sources":["../src/setupReport.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,oBAAoB,CAAC;IACvD,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AACF,eAAO,MAAM,WAAW,GACtB,QAAQ,WAAW,CAAC,QAAQ,CAAC,EAC7B,OAAO,MAAM,EAAE,EACf,SAAS,MAAM,KACd,WAA+D,CAAC"}

package/dist/setupReport.js

@@ -0,0 +1,2 @@
+export const setupReport = (status, files, message) => ({ operation: "setup", status, files, message });
+//# sourceMappingURL=setupReport.js.map

package/dist/setupReport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupReport.js","sourceRoot":"","sources":["../src/setupReport.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,WAAW,GAAG,CACzB,MAA6B,EAC7B,KAAe,EACf,OAAe,EACF,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC"}

package/dist/setupVercel.d.ts

@@ -0,0 +1,9 @@
+export declare const setupVercel: ({ root, slug, safe, file, dry, hasDeploy, }: {
+    root: string;
+    slug: string;
+    safe: (name: string) => string;
+    file: string;
+    dry: boolean;
+    hasDeploy: boolean;
+}) => import("./setupReport.js").SetupReport;
+//# sourceMappingURL=setupVercel.d.ts.map

package/dist/setupVercel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupVercel.d.ts","sourceRoot":"","sources":["../src/setupVercel.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,WAAW,GAAI,6CAOzB;IACD,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,OAAO,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;CACpB,2CAoGA,CAAC"}

package/dist/setupVercel.js

@@ -0,0 +1,72 @@
+import { setupReport } from "./setupReport.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { addDependency, hasDependency } from "./addDependency.js";
+import { packageRoot } from "./packageInfo.js";
+import { vercelInputSchema } from "./schemas.js";
+import { validateConfig } from "./validateConfig.js";
+const home = packageRoot;
+const json = (value) => JSON.stringify(value, null, 2) + "\n";
+export const setupVercel = ({ root, slug, safe, file, dry, hasDeploy, }) => {
+    if (hasDeploy)
+        throw new Error("Existing Terraform deploy block found. Vercel-only reference mode cannot silently replace it.");
+    const input = vercelInputSchema.parse(JSON.parse(readFileSync(safe(file), "utf8")));
+    const config = validateConfig({
+        version: 1,
+        mode: "vercel",
+        slug,
+        repository: input.repository,
+        approved: false,
+        account: input.account,
+        sites: input.sites,
+    }, root);
+    if (Object.keys(input).some((k) => !["repository", "account", "sites"].includes(k)))
+        throw new Error("Vercel input supports only repository, account and sites; ownership/import is separate.");
+    const path = safe(".arcnet/project.json");
+    const files = new Map([
+        [".arcnet/project.json", json(config)],
+        [".arcnet/.gitignore", "project.json.new\n"],
+        [
+            ".github/workflows/deploy-arc.yaml",
+            readFileSync(join(home, "templates/deploy-vercel.yaml"), "utf8"),
+        ],
+    ]);
+    if (existsSync(path)) {
+        const old = validateConfig(JSON.parse(readFileSync(path, "utf8")), root);
+        const previous = { ...old, approved: false };
+        const expected = { ...config, approved: false };
+        // Creation promotes a planned new site to an explicit reference; a setup rerun must preserve that receipt.
+        for (const [name, site] of Object.entries(expected.sites)) {
+            if (site.mode === "new" && previous.sites?.[name]?.mode === "existing") {
+                expected.sites[name] = {
+                    ...site,
+                    mode: "existing",
+                    projectId: previous.sites[name].projectId,
+                };
+                delete expected.sites[name].creationApproved;
+            }
+        }
+        if (!isDeepStrictEqual(previous, expected))
+            throw new Error("Existing ArcNet configuration differs. Review committed config instead of overwriting it. After explicit creation, update the source input to the returned existing reference.");
+        if (!hasDependency(root))
+            throw new Error("Incomplete installation: add the ArcNet package dependency.");
+        for (const name of files.keys())
+            if (!existsSync(safe(name)))
+                throw new Error(`Incomplete installation: restore ${name} from Git.`);
+        return setupReport("already-configured", [], "Already configured; preserved all settings and files.");
+    }
+    for (const name of files.keys())
+        if (existsSync(safe(name)))
+            throw new Error(`Refusing to overwrite ${name}. No files changed.`);
+    const manifest = addDependency(safe("package.json"));
+    if (dry)
+        return setupReport("dry-run", [...files.keys(), "package.json"], `Dry run: Vercel-only references for ${Object.keys(config.sites).join(", ")}. No files or cloud resources changed; no GCP/WIF/Terraform.`);
+    for (const [name, content] of files) {
+        mkdirSync(dirname(safe(name)), { recursive: true });
+        writeFileSync(safe(name), content, { flag: "wx" });
+    }
+    writeFileSync(safe("package.json"), manifest);
+    return setupReport("installed", [...files.keys(), "package.json"], "Generated Vercel-only config and GitHub workflow (approved=false). No zap.yaml changes, GCP, Terraform, DNS or project settings ownership. Offline plan: pnpm install, then pnpm exec arcnet plan");
+};
+//# sourceMappingURL=setupVercel.js.map

package/dist/setupVercel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setupVercel.js","sourceRoot":"","sources":["../src/setupVercel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,MAAM,IAAI,GAAG,WAAW,CAAC;AACzB,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAEvE,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,EAC1B,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,IAAI,EACJ,GAAG,EACH,SAAS,GAQV,EAAE,EAAE;IACH,IAAI,SAAS;QACX,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IAEJ,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CACnC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAC7C,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAC3B;QACE,OAAO,EAAE,CAAC;QACV,IAAI,EAAE,QAAQ;QACd,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,EACD,IAAI,CACL,CAAC;IAEF,IACE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CACrB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvD;QAED,MAAM,IAAI,KAAK,CACb,yFAAyF,CAC1F,CAAC;IACJ,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC;QACpB,CAAC,sBAAsB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACtC,CAAC,oBAAoB,EAAE,oBAAoB,CAAC;QAC5C;YACE,mCAAmC;YACnC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,8BAA8B,CAAC,EAAE,MAAM,CAAC;SACjE;KACF,CAAC,CAAC;IAEH,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QAEhD,2GAA2G;QAC3G,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,IAAI,KAAK,UAAU,EAAE,CAAC;gBACvE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG;oBACrB,GAAG,IAAI;oBACP,IAAI,EAAE,UAAU;oBAChB,SAAS,EAAE,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS;iBAC1C,CAAC;gBAEF,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAE,CAAC,gBAAgB,CAAC;YAChD,CAAC;QACH,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC;YACxC,MAAM,IAAI,KAAK,CACb,gLAAgL,CACjL,CAAC;QACJ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;QACJ,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;YAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,YAAY,CAAC,CAAC;QAC1E,OAAO,WAAW,CAChB,oBAAoB,EACpB,EAAE,EACF,uDAAuD,CACxD,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE;QAC7B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,qBAAqB,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;IACrD,IAAI,GAAG;QACL,OAAO,WAAW,CAChB,SAAS,EACT,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,EACjC,uCAAuC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,8DAA8D,CAC1I,CAAC;IAEJ,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC;QACpC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,WAAW,CAChB,WAAW,EACX,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,EAAE,cAAc,CAAC,EACjC,mMAAmM,CACpM,CAAC;AACJ,CAAC,CAAC"}

package/dist/stageSite.d.ts

@@ -0,0 +1,3 @@
+import type { VercelAccount, VercelSite } from "./schemas.js";
+export declare const stageSite: (root: string, site: VercelSite, account: VercelAccount) => string;
+//# sourceMappingURL=stageSite.d.ts.map

package/dist/stageSite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stageSite.d.ts","sourceRoot":"","sources":["../src/stageSite.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE9D,eAAO,MAAM,SAAS,GACpB,MAAM,MAAM,EACZ,MAAM,UAAU,EAChB,SAAS,aAAa,WAkCvB,CAAC"}

package/dist/stageSite.js

@@ -0,0 +1,31 @@
+import { cpSync, existsSync, lstatSync, mkdirSync, mkdtempSync, rmSync, writeFileSync, } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fail } from "./fail.js";
+import { inspectStaticTree } from "./inspectStaticTree.js";
+import { safePath } from "./safePath.js";
+export const stageSite = (root, site, account) => {
+    const output = safePath(root, site.output);
+    if (!existsSync(output) ||
+        !lstatSync(output).isDirectory() ||
+        !existsSync(join(output, "index.html")))
+        fail(`Static output needs index.html: ${site.output}`);
+    inspectStaticTree(output);
+    const stage = mkdtempSync(join(tmpdir(), "arcnet-static-"));
+    try {
+        mkdirSync(join(stage, ".vercel/output"), { recursive: true });
+        cpSync(output, join(stage, ".vercel/output/static"), { recursive: true });
+        writeFileSync(join(stage, ".vercel/output/config.json"), JSON.stringify(site.outputConfig));
+        writeFileSync(join(stage, ".vercel/project.json"), JSON.stringify({
+            projectId: site.projectId,
+            orgId: account.id,
+            projectName: site.projectName,
+        }));
+        return stage;
+    }
+    catch (e) {
+        rmSync(stage, { recursive: true, force: true });
+        throw e;
+    }
+};
+//# sourceMappingURL=stageSite.js.map

package/dist/stageSite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stageSite.js","sourceRoot":"","sources":["../src/stageSite.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,MAAM,EACN,UAAU,EACV,SAAS,EACT,SAAS,EACT,WAAW,EACX,MAAM,EACN,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAGzC,MAAM,CAAC,MAAM,SAAS,GAAG,CACvB,IAAY,EACZ,IAAgB,EAChB,OAAsB,EACtB,EAAE;IACF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3C,IACE,CAAC,UAAU,CAAC,MAAM,CAAC;QACnB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE;QAChC,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAEvC,IAAI,CAAC,mCAAmC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAE5D,IAAI,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,KAAK,EAAE,gBAAgB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,uBAAuB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,aAAa,CACX,IAAI,CAAC,KAAK,EAAE,4BAA4B,CAAC,EACzC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,CAClC,CAAC;QAEF,aAAa,CACX,IAAI,CAAC,KAAK,EAAE,sBAAsB,CAAC,EACnC,IAAI,CAAC,SAAS,CAAC;YACb,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,KAAK,EAAE,OAAO,CAAC,EAAE;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC,CACH,CAAC;QAEF,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC,CAAC"}

package/dist/validateConfig.d.ts

@@ -0,0 +1,3 @@
+import type { VercelConfig } from "./schemas.js";
+export declare const validateConfig: (input: unknown, root: string) => VercelConfig;
+//# sourceMappingURL=validateConfig.d.ts.map

package/dist/validateConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateConfig.d.ts","sourceRoot":"","sources":["../src/validateConfig.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAGjD,eAAO,MAAM,cAAc,GAAI,OAAO,OAAO,EAAE,MAAM,MAAM,KAAG,YAgB7D,CAAC"}

package/dist/validateConfig.js

@@ -0,0 +1,17 @@
+import { fail } from "./fail.js";
+import { safePath } from "./safePath.js";
+import { vercelConfigSchema } from "./schemas.js";
+export const validateConfig = (input, root) => {
+    const config = vercelConfigSchema.parse(input);
+    const identities = new Set();
+    for (const site of Object.values(config.sites)) {
+        for (const id of [site.projectId, site.projectName].filter((id) => Boolean(id))) {
+            if (identities.has(id))
+                fail("Duplicate Vercel project selection.");
+            identities.add(id);
+        }
+        safePath(root, site.output);
+    }
+    return config;
+};
+//# sourceMappingURL=validateConfig.js.map

package/dist/validateConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validateConfig.js","sourceRoot":"","sources":["../src/validateConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAc,EAAE,IAAY,EAAgB,EAAE;IAC3E,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,CACxD,CAAC,EAAE,EAAgB,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAClC,EAAE,CAAC;YACF,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACpE,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAED,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC,CAAC"}