@nmakarov/cli-toolkit 0.29.0 → 0.33.0

package/dist/deploy.cjs

@@ -0,0 +1,1166 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/deploy/index.js
+var deploy_exports = {};
+__export(deploy_exports, {
+  REMOTE_CLI_REL: () => REMOTE_CLI_REL,
+  activateRelease: () => activateRelease,
+  appendDeployLog: () => appendDeployLog,
+  bootstrapHost: () => bootstrapHost,
+  bumpPatchVersion: () => bumpPatchVersion,
+  cloneRepo: () => cloneRepo,
+  createRelease: () => createRelease,
+  defineService: () => defineService,
+  deployService: () => deployService,
+  deriveRepoDirName: () => deriveRepoDirName,
+  enableNginxUpstream: () => enableNginxUpstream,
+  ensureDeployKeyOnRemote: () => ensureDeployKeyOnRemote,
+  ensureEnvOnRemote: () => ensureEnvOnRemote,
+  ensureRemoteRepo: () => ensureRemoteRepo,
+  ensureRepoDependencies: () => ensureRepoDependencies,
+  initServiceStructure: () => initServiceStructure,
+  installDeps: () => installDeps,
+  listReleases: () => listReleases,
+  loadServices: () => loadServices,
+  npmEnv: () => npmEnv,
+  npmInstallEnv: () => npmInstallEnv,
+  parseGitHost: () => parseGitHost,
+  prepareGitHost: () => prepareGitHost,
+  provisionService: () => provisionService,
+  pruneReleases: () => pruneReleases,
+  pullRepo: () => pullRepo,
+  readCurrentRelease: () => readCurrentRelease,
+  readReleaseBuildInfo: () => readReleaseBuildInfo,
+  releaseDir: () => releaseDir,
+  releaseStamp: () => releaseStamp,
+  reloadPm2: () => reloadPm2,
+  resolveNextVersion: () => resolveNextVersion,
+  resolveServiceFrom: () => resolveServiceFrom,
+  rollbackService: () => rollbackService,
+  run: () => run,
+  runReleaseTests: () => runReleaseTests,
+  runRemoteCli: () => runRemoteCli,
+  runRemoteStatus: () => runRemoteStatus,
+  runShell: () => runShell,
+  scrubEnvContent: () => scrubEnvContent,
+  servicePaths: () => servicePaths,
+  shellQuote: () => shellQuote,
+  sshRun: () => sshRun,
+  syncEnv: () => syncEnv,
+  writeReleaseBuildInfo: () => writeReleaseBuildInfo
+});
+module.exports = __toCommonJS(deploy_exports);
+
+// src/deploy/service.js
+function deriveRepoDirName(repoUrl) {
+  const tail = String(repoUrl ?? "").split("/").pop() ?? "repo";
+  return tail.replace(/\.git$/, "") || "repo";
+}
+function defineService(service) {
+  if (!service?.name) throw new Error("service manifest needs a `name`");
+  if (!service.appsRoot) throw new Error(`service "${service.name}" needs an appsRoot`);
+  if (!service.repoUrl) throw new Error(`service "${service.name}" needs a repoUrl`);
+  if (!service.pm2?.script) throw new Error(`service "${service.name}" needs pm2.script`);
+  const pm2 = {
+    appName: service.name,
+    args: "",
+    ...service.pm2
+  };
+  const nginx = service.nginx ? { siteName: service.name, ...service.nginx } : null;
+  return {
+    repoDirName: deriveRepoDirName(service.repoUrl),
+    repoSubdir: "",
+    keepReleases: 3,
+    testCommand: null,
+    envScrubPatterns: [],
+    legacyRepoEnv: null,
+    buildInfoPath: "build-info.json",
+    deployKey: null,
+    requireEnv: false,
+    ...service,
+    pm2,
+    nginx
+  };
+}
+
+// src/deploy/paths.js
+var import_node_path = require("path");
+function servicePaths(service) {
+  const root = service.appsRoot;
+  const repoDirName = service.repoDirName ?? "repo";
+  const repoSubdir = service.repoSubdir ?? "";
+  const repo = (0, import_node_path.join)(root, repoDirName);
+  const repoRun = repoSubdir ? (0, import_node_path.join)(repo, repoSubdir) : repo;
+  return {
+    root,
+    repo,
+    repoRun,
+    repoEnv: (0, import_node_path.join)(repoRun, ".env"),
+    releases: (0, import_node_path.join)(root, "releases"),
+    shared: (0, import_node_path.join)(root, "shared"),
+    logs: (0, import_node_path.join)(root, "logs"),
+    current: (0, import_node_path.join)(root, "current"),
+    sharedEnv: (0, import_node_path.join)(root, "shared", ".env"),
+    ecosystem: (0, import_node_path.join)(root, "shared", "ecosystem.config.cjs"),
+    deployLog: (0, import_node_path.join)(root, "logs", "deploy.log"),
+    lockHashFile: (0, import_node_path.join)(root, "shared", ".package-lock.sha256")
+  };
+}
+function releaseStamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function releaseDir(releasesRoot, stamp) {
+  return (0, import_node_path.join)(releasesRoot, stamp);
+}
+
+// src/deploy/run.js
+var import_node_child_process = require("child_process");
+function npmEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  delete env.NODE_ENV;
+  return env;
+}
+function npmInstallEnv(baseEnv = process.env) {
+  return {
+    ...npmEnv(baseEnv),
+    NPM_CONFIG_PRODUCTION: "false",
+    npm_config_production: "false"
+  };
+}
+function run(cmd, args, options = {}) {
+  const { cwd, env, logger } = options;
+  return new Promise((resolve2, reject) => {
+    logger?.info?.(`$ ${cmd} ${args.join(" ")}${cwd ? `  (cwd=${cwd})` : ""}`);
+    const child = (0, import_node_child_process.spawn)(cmd, args, {
+      cwd,
+      env: env ?? process.env,
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve2();
+      else reject(new Error(`${cmd} exited with code ${code}`));
+    });
+  });
+}
+function runShell(command, options = {}) {
+  return run("bash", ["-lc", command], options);
+}
+
+// src/deploy/log.js
+var import_promises = require("fs/promises");
+async function appendDeployLog(deployLogPath, message) {
+  await (0, import_promises.mkdir)(deployLogPath.replace(/\/[^/]+$/, ""), { recursive: true });
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`;
+  await (0, import_promises.appendFile)(deployLogPath, line);
+}
+
+// src/deploy/git.js
+var import_promises2 = require("fs/promises");
+async function pathExists(path) {
+  try {
+    await (0, import_promises2.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function cloneRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (await pathExists(paths.repo)) {
+    throw new Error(`Repo already exists at ${paths.repo} \u2014 use git pull instead`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git clone ${service.repoUrl} ${paths.repo}`);
+    return;
+  }
+  await run("git", ["clone", service.repoUrl, paths.repo], { logger });
+  logger.info(`cloned ${service.repoUrl} \u2192 ${paths.repo}`);
+}
+async function pullRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (!await pathExists(paths.repo)) {
+    throw new Error(`Repo missing at ${paths.repo} \u2014 run provision first`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git -C ${paths.repo} pull --ff-only`);
+    return;
+  }
+  await run("git", ["-C", paths.repo, "pull", "--ff-only"], { logger });
+  logger.info(`pulled ${paths.repo}`);
+}
+
+// src/deploy/release.js
+var import_promises3 = require("fs/promises");
+var import_node_path2 = require("path");
+var SKIP_TOP = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function shouldCopyEntry(srcPath) {
+  const parts = srcPath.split(import_node_path2.sep);
+  if (parts.some((p) => p === "node_modules" || p === ".git")) return false;
+  const top = parts.at(-1);
+  if (parts.length === 1 && SKIP_TOP.has(top)) return false;
+  return true;
+}
+async function createRelease(service, options = {}) {
+  const { stamp = releaseStamp(), dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dest = releaseDir(paths.releases, stamp);
+  if (dryRun) {
+    logger.info(`[dryRun] would copy ${paths.repoRun} \u2192 ${dest}`);
+    return { stamp, path: dest };
+  }
+  await (0, import_promises3.mkdir)(paths.releases, { recursive: true });
+  await (0, import_promises3.cp)(paths.repoRun, dest, {
+    recursive: true,
+    filter: (src) => shouldCopyEntry(src)
+  });
+  logger.info(`release ${stamp} created at ${dest}`);
+  return { stamp, path: dest };
+}
+async function readCurrentRelease(paths) {
+  try {
+    const target = await (0, import_promises3.readlink)(paths.current);
+    return target.startsWith("/") ? target : (0, import_node_path2.join)((0, import_node_path2.dirname)(paths.current), target);
+  } catch {
+    return null;
+  }
+}
+async function listReleases(paths) {
+  let names;
+  try {
+    names = await (0, import_promises3.readdir)(paths.releases);
+  } catch {
+    return [];
+  }
+  const entries = [];
+  for (const name of names) {
+    const full = releaseDir(paths.releases, name);
+    const s = await (0, import_promises3.stat)(full);
+    if (s.isDirectory()) entries.push({ name, path: full, mtime: s.mtime });
+  }
+  entries.sort((a, b) => b.name.localeCompare(a.name));
+  return entries;
+}
+
+// src/deploy/activate.js
+var import_promises4 = require("fs/promises");
+var import_node_path3 = require("path");
+async function activateRelease(releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would activate ${releasePath} \u2192 ${paths.current}`);
+    return;
+  }
+  try {
+    await (0, import_promises4.unlink)(paths.current);
+  } catch {
+  }
+  await (0, import_promises4.symlink)(releasePath, paths.current);
+  const envLink = (0, import_node_path3.join)(releasePath, ".env");
+  try {
+    await (0, import_promises4.unlink)(envLink);
+  } catch {
+  }
+  await (0, import_promises4.symlink)(paths.sharedEnv, envLink);
+  logger.info(`active release: ${releasePath}`);
+}
+
+// src/deploy/deps.js
+var import_node_crypto = require("crypto");
+var import_promises5 = require("fs/promises");
+var import_node_path4 = require("path");
+async function pathExists2(path) {
+  try {
+    await (0, import_promises5.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function lockfileHash(releasePath) {
+  const lockPath = (0, import_node_path4.join)(releasePath, "package-lock.json");
+  try {
+    const buf = await (0, import_promises5.readFile)(lockPath);
+    return (0, import_node_crypto.createHash)("sha256").update(buf).digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function readHashFile(path) {
+  try {
+    return (await (0, import_promises5.readFile)(path, "utf8")).trim();
+  } catch {
+    return null;
+  }
+}
+async function npmInstall(releasePath, hasLock, logger) {
+  await (0, import_promises5.rm)((0, import_node_path4.join)(releasePath, "node_modules"), { recursive: true, force: true });
+  const cmd = hasLock ? ["ci", "--include=dev"] : ["install", "--include=dev", "--no-audit", "--no-fund"];
+  logger.info(`running npm ${cmd.join(" ")} in ${releasePath}`);
+  await run("npm", cmd, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+async function installDeps(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deps in ${releasePath}`);
+    return { hash: null, copied: false };
+  }
+  const hash = await lockfileHash(releasePath);
+  const hasLock = hash !== null;
+  const hashMarker = (0, import_node_path4.join)(releasePath, ".deploy-package-lock.sha256");
+  const currentPath = await readCurrentRelease(paths);
+  let copied = false;
+  if (hasLock && currentPath && await pathExists2((0, import_node_path4.join)(currentPath, "node_modules"))) {
+    const currentHash = await readHashFile((0, import_node_path4.join)(currentPath, ".deploy-package-lock.sha256"));
+    if (currentHash === hash) {
+      logger.info("lockfile unchanged \u2014 copying node_modules from current release");
+      await (0, import_promises5.cp)((0, import_node_path4.join)(currentPath, "node_modules"), (0, import_node_path4.join)(releasePath, "node_modules"), {
+        recursive: true,
+        force: true
+      });
+      copied = true;
+    }
+  }
+  if (!copied) {
+    await npmInstall(releasePath, hasLock, logger);
+  }
+  if (hasLock) {
+    await (0, import_promises5.writeFile)(hashMarker, `${hash}
+`, "utf8");
+    await (0, import_promises5.mkdir)(paths.shared, { recursive: true });
+    await (0, import_promises5.writeFile)(paths.lockHashFile, `${hash}
+`, "utf8");
+  }
+  return { hash, copied };
+}
+
+// src/deploy/test.js
+var import_promises6 = require("fs/promises");
+var import_node_path5 = require("path");
+async function runReleaseTests(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (!service.testCommand) {
+    logger.info("no testCommand configured \u2014 skipping tests");
+    return;
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would run "${service.testCommand}" in ${releasePath}`);
+    return;
+  }
+  const envLink = (0, import_node_path5.join)(releasePath, ".env");
+  try {
+    await (0, import_promises6.unlink)(envLink);
+  } catch {
+  }
+  await (0, import_promises6.symlink)(paths.sharedEnv, envLink);
+  logger.info(`running "${service.testCommand}" in ${releasePath}`);
+  await runShell(service.testCommand, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+
+// src/deploy/prune.js
+var import_promises7 = require("fs/promises");
+async function pruneReleases(service, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keep = service.keepReleases ?? 3;
+  const releases = await listReleases(paths);
+  let activeName = null;
+  try {
+    const target = await (0, import_promises7.readlink)(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+  }
+  const keepSet = /* @__PURE__ */ new Set();
+  for (const rel of releases) {
+    if (keepSet.size < keep) keepSet.add(rel.name);
+  }
+  if (activeName) keepSet.add(activeName);
+  const toRemove = releases.filter((rel) => !keepSet.has(rel.name));
+  for (const rel of toRemove) {
+    if (dryRun) {
+      logger.info(`[dryRun] would rm -rf ${rel.path}`);
+    } else {
+      await (0, import_promises7.rm)(rel.path, { recursive: true, force: true });
+      logger.info(`pruned ${rel.path}`);
+    }
+  }
+  return { removed: toRemove.map((r) => r.name) };
+}
+
+// src/deploy/pm2.js
+async function reloadPm2(paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would pm2 startOrReload ${paths.ecosystem} --update-env`);
+    return;
+  }
+  await runShell(`pm2 startOrReload "${paths.ecosystem}" --update-env`, { logger });
+  logger.info("pm2 reloaded");
+}
+
+// src/deploy/nginx.js
+var import_promises8 = require("fs/promises");
+var import_node_os = require("os");
+var import_node_path6 = require("path");
+async function hasTlsCert(certPath) {
+  try {
+    await runShell(`sudo test -f '${certPath}'`, {});
+    return true;
+  } catch {
+    return false;
+  }
+}
+function proxyBlock(port) {
+  return `  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 120s;
+  }`;
+}
+function buildNginxConfig(service) {
+  const { nginx, pm2 } = service;
+  const certDir = `/etc/letsencrypt/live/${nginx.fqdn}`;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (proxy mode)
+# ${nginx.fqdn} \u2192 127.0.0.1:${pm2.port}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  server_name ${nginx.fqdn};
+
+  ssl_certificate ${certDir}/fullchain.pem;
+  ssl_certificate_key ${certDir}/privkey.pem;
+  include /etc/letsencrypt/options-ssl-nginx.conf;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+function buildNginxConfigHttpOnly(service) {
+  const { nginx, pm2 } = service;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (HTTP proxy, no TLS cert yet)
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+async function enableNginxUpstream(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const { nginx } = service;
+  if (!nginx) {
+    logger.info("no nginx config on service \u2014 skipping nginx step");
+    return { skipped: true };
+  }
+  const siteAvailable = `/etc/nginx/sites-available/${nginx.siteName}`;
+  const siteEnabled = `/etc/nginx/sites-enabled/${nginx.siteName}`;
+  const cert = `/etc/letsencrypt/live/${nginx.fqdn}/fullchain.pem`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${siteAvailable} (proxy \u2192 127.0.0.1:${service.pm2.port}) and reload nginx`);
+    return { hasCert: null };
+  }
+  const hasCert = await hasTlsCert(cert);
+  const config = hasCert ? buildNginxConfig(service) : buildNginxConfigHttpOnly(service);
+  const tmp = (0, import_node_path6.join)((0, import_node_os.tmpdir)(), `${service.name}-nginx.conf`);
+  await (0, import_promises8.writeFile)(tmp, config);
+  await runShell(
+    `sudo cp '${tmp}' '${siteAvailable}' && sudo ln -sf '${siteAvailable}' '${siteEnabled}' && sudo nginx -t && sudo systemctl reload nginx`,
+    { logger }
+  );
+  logger.info(`nginx upstream enabled for ${nginx.fqdn} \u2192 127.0.0.1:${service.pm2.port} (tls=${hasCert})`);
+  return { hasCert };
+}
+
+// src/deploy/sync-env.js
+var import_promises9 = require("fs/promises");
+function scrubEnvContent(content, patterns = []) {
+  const regexes = patterns.map((p) => p instanceof RegExp ? p : new RegExp(p));
+  if (regexes.length === 0) return content;
+  return content.split("\n").filter((line) => !regexes.some((re) => re.test(line.trim()))).join("\n");
+}
+async function pathExists3(path) {
+  try {
+    await (0, import_promises9.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function syncEnv(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const patterns = service.envScrubPatterns ?? [];
+  if (dryRun) {
+    logger.info(`[dryRun] would sync ${paths.repoEnv} \u2192 ${paths.sharedEnv}`);
+    return { source: paths.repoEnv, dest: paths.sharedEnv };
+  }
+  let source = paths.repoEnv;
+  if (!await pathExists3(source) && service.legacyRepoEnv && await pathExists3(service.legacyRepoEnv)) {
+    logger.info(`using legacy env: ${service.legacyRepoEnv}`);
+    source = service.legacyRepoEnv;
+  }
+  await (0, import_promises9.mkdir)(paths.shared, { recursive: true });
+  if (!await pathExists3(source)) {
+    if (service.requireEnv) {
+      throw new Error(
+        `No .env found at ${paths.repoEnv}` + (service.legacyRepoEnv ? ` or ${service.legacyRepoEnv}` : "") + " \u2014 place .env on the host or run the remote deploy from a laptop with a local .env (auto-scp)"
+      );
+    }
+    if (!await pathExists3(paths.sharedEnv)) {
+      await (0, import_promises9.writeFile)(paths.sharedEnv, "", { mode: 384 });
+    }
+    logger.warn(`no .env found (source ${source}) \u2014 using empty ${paths.sharedEnv}`);
+    return { source: null, dest: paths.sharedEnv };
+  }
+  const raw = await (0, import_promises9.readFile)(source, "utf8");
+  await (0, import_promises9.writeFile)(paths.sharedEnv, scrubEnvContent(raw, patterns), { mode: 384 });
+  logger.info(`synced ${source} \u2192 ${paths.sharedEnv}`);
+  return { source, dest: paths.sharedEnv };
+}
+
+// src/deploy/build-info.js
+var import_promises10 = require("fs/promises");
+var import_node_path7 = require("path");
+var import_node_child_process2 = require("child_process");
+var import_node_util = require("util");
+var execFileAsync = (0, import_node_util.promisify)(import_node_child_process2.execFile);
+function bumpPatchVersion(version) {
+  const parts = String(version).trim().split(".");
+  const major = Number.parseInt(parts[0], 10) || 0;
+  const minor = Number.parseInt(parts[1], 10) || 0;
+  const patch = Number.parseInt(parts[2], 10) || 0;
+  return `${major}.${minor}.${patch + 1}`;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await (0, import_promises10.readFile)(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function gitShortCommit(repoPath) {
+  try {
+    const { stdout } = await execFileAsync("git", ["-C", repoPath, "rev-parse", "--short", "HEAD"], {
+      encoding: "utf8"
+    });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function resolveNextVersion(service, paths, pkgPath) {
+  const pkg = await readJson(pkgPath) ?? {};
+  const baseVersion = pkg.version || "0.1.0";
+  const currentPath = await readCurrentRelease(paths);
+  if (currentPath) {
+    const active = await readJson((0, import_node_path7.join)(currentPath, service.buildInfoPath));
+    if (active?.version) return bumpPatchVersion(active.version);
+  }
+  return baseVersion;
+}
+async function readReleaseBuildInfo(service, releasePath) {
+  return readJson((0, import_node_path7.join)(releasePath, service.buildInfoPath));
+}
+async function writeReleaseBuildInfo(service, releasePath, { stamp, dryRun = false, logger = console }) {
+  const paths = servicePaths(service);
+  const pkgPath = (0, import_node_path7.join)(paths.repoRun, "package.json");
+  const version = await resolveNextVersion(service, paths, pkgPath);
+  const gitCommit = await gitShortCommit(paths.repo);
+  const buildInfo = {
+    version,
+    release: stamp,
+    deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    gitCommit,
+    service: service.name
+  };
+  const dest = (0, import_node_path7.join)(releasePath, service.buildInfoPath);
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${dest} (${JSON.stringify(buildInfo)})`);
+    return buildInfo;
+  }
+  await (0, import_promises10.mkdir)((0, import_node_path7.dirname)(dest), { recursive: true });
+  await (0, import_promises10.writeFile)(dest, `${JSON.stringify(buildInfo, null, 2)}
+`, { mode: 420 });
+  const gitSuffix = gitCommit ? ` git=${gitCommit}` : "";
+  logger.info(`build info: v${version} release=${stamp}${gitSuffix}`);
+  return buildInfo;
+}
+
+// src/deploy/init-structure.js
+var import_promises11 = require("fs/promises");
+var import_node_path8 = require("path");
+async function pathExists4(path) {
+  try {
+    await (0, import_promises11.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function requireDeployRoot(parentDir, serviceRoot) {
+  if (await pathExists4(parentDir)) return;
+  throw new Error(
+    `Cannot create ${serviceRoot}: parent directory ${parentDir} does not exist.
+This is meant to run on the target host (where ${parentDir} exists). For a local dry run use --appsRoot=/tmp/<service>.`
+  );
+}
+function buildEcosystemConfig(service, paths) {
+  const { pm2 } = service;
+  const outLog = (0, import_node_path8.join)(paths.logs, `${pm2.appName}.out.log`);
+  const errLog = (0, import_node_path8.join)(paths.logs, `${pm2.appName}.err.log`);
+  return `/**
+ * pm2 ecosystem for ${service.name} \u2014 seeded by cli-toolkit deploy (init).
+ *
+ * cwd points at the \`current\` symlink (created on first deploy).
+ * Tweak \`args\` here, then: pm2 reload ${paths.ecosystem} --update-env
+ */
+module.exports = {
+    apps: [
+        {
+            name: "${pm2.appName}",
+            script: "${pm2.script}",
+            cwd: "${paths.current}",
+            args: "${pm2.args}",
+            instances: 1,
+            exec_mode: "fork",
+            autorestart: true,
+            min_uptime: "10s",
+            max_restarts: 10,
+            restart_delay: 2000,
+            max_memory_restart: "1500M",
+            out_file: "${outLog}",
+            error_file: "${errLog}",
+            merge_logs: true,
+            time: true,
+            env: {
+                NODE_ENV: "production",
+            },
+        },
+    ],
+};
+`;
+}
+async function initServiceStructure(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dirs = [paths.releases, paths.shared, paths.logs];
+  const created = [];
+  const skipped = [];
+  if (!dryRun) {
+    await requireDeployRoot((0, import_node_path8.dirname)(paths.root), paths.root);
+  }
+  for (const dir of dirs) {
+    if (await pathExists4(dir)) {
+      skipped.push(dir);
+      continue;
+    }
+    if (!dryRun) await (0, import_promises11.mkdir)(dir, { recursive: true });
+    created.push(dir);
+  }
+  let ecosystemCreated = false;
+  if (await pathExists4(paths.ecosystem)) {
+    skipped.push(paths.ecosystem);
+  } else {
+    if (!dryRun) {
+      await (0, import_promises11.writeFile)(paths.ecosystem, buildEcosystemConfig(service, paths), { mode: 420 });
+    }
+    ecosystemCreated = true;
+    created.push(paths.ecosystem);
+  }
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] init-structure service=${service.name} dryRun=${dryRun} created=${created.length} skipped=${skipped.length}
+`;
+  if (!dryRun) {
+    await (0, import_promises11.mkdir)(paths.logs, { recursive: true });
+    await (0, import_promises11.appendFile)(paths.deployLog, line);
+  }
+  logger.info(`service=${service.name} appsRoot=${paths.root}`);
+  logger.info(`created: ${created.length ? created.join(", ") : "(none)"}`);
+  logger.info(`already present: ${skipped.length ? skipped.join(", ") : "(none)"}`);
+  if (ecosystemCreated) logger.info(`seeded ${paths.ecosystem}`);
+  return { paths, created, skipped, ecosystemCreated };
+}
+
+// src/deploy/bootstrap-host.js
+var import_node_child_process3 = require("child_process");
+var import_promises12 = require("fs/promises");
+var import_node_os2 = require("os");
+var import_node_path9 = require("path");
+async function pathExists5(path) {
+  try {
+    await (0, import_promises12.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome(path) {
+  return path.startsWith("~/") ? (0, import_node_path9.join)((0, import_node_os2.homedir)(), path.slice(2)) : path;
+}
+async function ensurePm2Startup(options = {}) {
+  const { user = "ubuntu", dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info("[dryRun] would configure pm2 startup systemd");
+    return;
+  }
+  try {
+    (0, import_node_child_process3.execSync)("pm2 ping", { stdio: "ignore" });
+  } catch {
+  }
+  try {
+    const out = (0, import_node_child_process3.execSync)(`pm2 startup systemd -u ${user} --hp /home/${user}`, { encoding: "utf8" });
+    const sudoLine = out.split("\n").find((l) => l.trim().startsWith("sudo"));
+    if (sudoLine) {
+      (0, import_node_child_process3.execSync)(sudoLine.trim(), { stdio: "inherit" });
+      logger.info("pm2 startup systemd configured");
+    }
+  } catch (err) {
+    logger.warn(`pm2 startup skipped or already configured: ${err.message}`);
+  }
+}
+async function installDeployKey(deployKeyPath, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keyPath = expandHome(deployKeyPath);
+  if (!await pathExists5(keyPath)) {
+    logger.warn(`deploy key not found at ${keyPath} \u2014 skipping git ssh setup`);
+    return;
+  }
+  const keyBase = (0, import_node_path9.basename)(keyPath);
+  const sshDir = (0, import_node_path9.join)((0, import_node_os2.homedir)(), ".ssh");
+  const destKey = (0, import_node_path9.join)(sshDir, keyBase);
+  const configPath = (0, import_node_path9.join)(sshDir, "config");
+  const block = `
+Host github.com
+  HostName github.com
+  User git
+  IdentityFile ${destKey}
+  IdentitiesOnly yes
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deploy key ${keyPath} \u2192 ${destKey}`);
+    return;
+  }
+  await (0, import_promises12.mkdir)(sshDir, { recursive: true, mode: 448 });
+  await (0, import_promises12.copyFile)(keyPath, destKey);
+  await (0, import_promises12.chmod)(destKey, 384);
+  let config = "";
+  if (await pathExists5(configPath)) config = await (0, import_promises12.readFile)(configPath, "utf8");
+  if (!config.includes("Host github.com")) {
+    await (0, import_promises12.writeFile)(configPath, `${config.trimEnd()}
+${block}
+`, { mode: 384 });
+    logger.info("updated ~/.ssh/config for github.com");
+  }
+  logger.info(`deploy key installed at ${destKey}`);
+}
+async function installLogrotate(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const conf = `/etc/logrotate.d/${service.name}`;
+  const body = `${service.appsRoot}/logs/*.log {
+  daily
+  rotate 14
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${conf}`);
+    return;
+  }
+  const tmp = (0, import_node_path9.join)("/tmp", `${service.name}-logrotate.conf`);
+  await (0, import_promises12.writeFile)(tmp, body);
+  await runShell(`sudo cp '${tmp}' '${conf}'`, { logger });
+  logger.info(`logrotate config written: ${conf}`);
+}
+async function bootstrapHost(service, options = {}) {
+  const { deployKey = service.deployKey, user = "ubuntu", dryRun = false, logger = console } = options;
+  await ensurePm2Startup({ user, dryRun, logger });
+  if (deployKey) await installDeployKey(deployKey, { dryRun, logger });
+  await installLogrotate(service, { dryRun, logger });
+  logger.info("bootstrap-host complete");
+}
+
+// src/deploy/deploy-service.js
+async function deployService(service, options = {}) {
+  const {
+    dryRun = false,
+    skipPull = false,
+    skipTests = false,
+    skipNginx = false,
+    logger = console
+  } = options;
+  const paths = servicePaths(service);
+  await initServiceStructure(service, { dryRun, logger });
+  if (!skipPull) await pullRepo(service, { dryRun, logger });
+  await syncEnv(service, { dryRun, logger });
+  const { stamp, path: releasePath } = await createRelease(service, { dryRun, logger });
+  await writeReleaseBuildInfo(service, releasePath, { stamp, dryRun, logger });
+  await installDeps(service, releasePath, paths, { dryRun, logger });
+  if (!skipTests) await runReleaseTests(service, releasePath, paths, { dryRun, logger });
+  await activateRelease(releasePath, paths, { dryRun, logger });
+  await pruneReleases(service, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  if (!skipNginx) await enableNginxUpstream(service, { dryRun, logger });
+  const summary = `deploy complete stamp=${stamp} dryRun=${dryRun}`;
+  logger.info(summary);
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { stamp, releasePath };
+}
+
+// src/deploy/provision-service.js
+var import_promises13 = require("fs/promises");
+async function pathExists6(path) {
+  try {
+    await (0, import_promises13.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function provisionService(service, options = {}) {
+  const {
+    dryRun = false,
+    deploy = true,
+    skipBootstrap = true,
+    deployKey,
+    logger = console
+  } = options;
+  if (!skipBootstrap) {
+    await bootstrapHost(service, { deployKey, dryRun, logger });
+  }
+  await initServiceStructure(service, { dryRun, logger });
+  const paths = servicePaths(service);
+  if (await pathExists6(paths.repo)) {
+    logger.info(`repo exists at ${paths.repo} \u2014 pulling`);
+    await pullRepo(service, { dryRun, logger });
+  } else {
+    await cloneRepo(service, { dryRun, logger });
+  }
+  await syncEnv(service, { dryRun, logger });
+  if (deploy) {
+    await deployService(service, { dryRun, logger, skipPull: true });
+  } else {
+    logger.info("provision complete (deploy skipped)");
+  }
+}
+
+// src/deploy/rollback-service.js
+var import_promises14 = require("fs/promises");
+async function rollbackService(service, options = {}) {
+  const { release: targetName, dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const releases = await listReleases(paths);
+  if (releases.length === 0) throw new Error("No releases to roll back to");
+  let activeName = null;
+  try {
+    const target = await (0, import_promises14.readlink)(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+    throw new Error("No active release (current symlink missing)");
+  }
+  let rollbackTarget;
+  if (targetName) {
+    rollbackTarget = releases.find((r) => r.name === targetName);
+    if (!rollbackTarget) throw new Error(`Release not found: ${targetName}`);
+  } else {
+    rollbackTarget = releases.find((r) => r.name !== activeName);
+    if (!rollbackTarget) throw new Error("No previous release to roll back to");
+  }
+  if (rollbackTarget.name === activeName) throw new Error(`Already on release ${activeName}`);
+  logger.info(`rollback ${activeName} \u2192 ${rollbackTarget.name}`);
+  const buildInfo = await readReleaseBuildInfo(service, rollbackTarget.path);
+  if (buildInfo?.version) {
+    logger.info(`rollback target: v${buildInfo.version} release=${buildInfo.release ?? rollbackTarget.name}`);
+  }
+  await activateRelease(rollbackTarget.path, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  const summary = `rollback ${activeName} \u2192 ${rollbackTarget.name} dryRun=${dryRun}`;
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { from: activeName, to: rollbackTarget.name, path: rollbackTarget.path };
+}
+
+// src/deploy/ssh-remote.js
+var import_promises15 = require("fs/promises");
+var import_node_os3 = require("os");
+var import_node_path10 = require("path");
+var import_node_child_process4 = require("child_process");
+var REMOTE_CLI_REL = "node_modules/@nmakarov/cli-toolkit/scripts/deploy/cli.js";
+async function pathExists7(path) {
+  try {
+    await (0, import_promises15.access)(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome2(path) {
+  return path.startsWith("~/") ? (0, import_node_path10.join)((0, import_node_os3.homedir)(), path.slice(2)) : path;
+}
+function resolveLocalEnvPath(envFile) {
+  if (envFile) {
+    const expanded = expandHome2(envFile);
+    return expanded.startsWith("/") ? expanded : (0, import_node_path10.join)(process.cwd(), expanded);
+  }
+  return (0, import_node_path10.join)(process.cwd(), ".env");
+}
+function parseGitHost(repoUrl) {
+  const u = String(repoUrl ?? "");
+  let m = u.match(/^[^@]+@([^:]+):/);
+  if (m) return m[1];
+  m = u.match(/^ssh:\/\/[^@]+@([^/:]+)/);
+  if (m) return m[1];
+  return null;
+}
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+function sshRun(host, remoteCommand, options = {}) {
+  const { logger } = options;
+  return new Promise((resolve2, reject) => {
+    logger?.info?.(`ssh ${host} ${remoteCommand.slice(0, 120)}${remoteCommand.length > 120 ? "\u2026" : ""}`);
+    const child = (0, import_node_child_process4.spawn)("ssh", [host, remoteCommand], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve2() : reject(new Error(`ssh ${host} exited with code ${code}`)));
+  });
+}
+function scp(localPath, remoteSpec) {
+  return new Promise((resolve2, reject) => {
+    const child = (0, import_node_child_process4.spawn)("scp", [localPath, remoteSpec], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve2() : reject(new Error(`scp exited with code ${code}`)));
+  });
+}
+async function ensureDeployKeyOnRemote(host, deployKeyPath, options = {}) {
+  const { logger = console } = options;
+  if (!deployKeyPath) return false;
+  const localPath = expandHome2(deployKeyPath);
+  if (!await pathExists7(localPath)) return false;
+  const keyBase = (0, import_node_path10.basename)(localPath);
+  logger.info(`copying deploy key ${localPath} \u2192 ${host}:~/.ssh/${keyBase}`);
+  await sshRun(host, "mkdir -p ~/.ssh && chmod 700 ~/.ssh", { logger });
+  await scp(localPath, `${host}:.ssh/${keyBase}`, { logger });
+  await sshRun(host, `chmod 600 ~/.ssh/${keyBase}`, { logger });
+  return true;
+}
+async function prepareGitHost(host, options = {}) {
+  const { logger = console, gitHost, keyBasename } = options;
+  if (!gitHost) return;
+  const configBlock = keyBasename ? `if ! grep -q 'Host ${gitHost}' ~/.ssh/config 2>/dev/null; then
+  printf '%s\\n' '' 'Host ${gitHost}' '  HostName ${gitHost}' '  User git' '  IdentityFile ~/.ssh/${keyBasename}' '  IdentitiesOnly yes' >> ~/.ssh/config
+  chmod 600 ~/.ssh/config
+  echo "configured ~/.ssh/config for ${gitHost}"
+fi` : `:`;
+  const script = `
+set -euo pipefail
+mkdir -p ~/.ssh
+chmod 700 ~/.ssh
+if ! grep -q '^${gitHost}' ~/.ssh/known_hosts 2>/dev/null; then
+  ssh-keyscan -t ed25519,rsa ${gitHost} >> ~/.ssh/known_hosts 2>/dev/null
+  echo "added ${gitHost} to known_hosts"
+fi
+${configBlock}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+async function ensureRepoDependencies(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  await sshRun(
+    host,
+    `cd ${run2} && if [ ! -d node_modules/@nmakarov/cli-toolkit ] || [ package-lock.json -nt node_modules/.package-lock.json ]; then npm ci; fi`,
+    { logger }
+  );
+}
+async function ensureEnvOnRemote(host, service, options = {}) {
+  const { logger = console, envFile } = options;
+  const paths = servicePaths(service);
+  const localPath = resolveLocalEnvPath(envFile);
+  if (!await pathExists7(localPath)) return false;
+  logger.info(`copying .env ${localPath} \u2192 ${host}:${paths.repoEnv}`);
+  await sshRun(host, `mkdir -p ${shellQuote((0, import_node_path10.dirname)(paths.repoEnv))}`, { logger });
+  const scrubbed = scrubEnvContent(await (0, import_promises15.readFile)(localPath, "utf8"), service.envScrubPatterns ?? []);
+  const tmp = (0, import_node_path10.join)((0, import_node_os3.tmpdir)(), `deploy-env-${Date.now()}`);
+  await (0, import_promises15.writeFile)(tmp, scrubbed, { mode: 384 });
+  await scp(tmp, `${host}:${paths.repoEnv}`, { logger });
+  await sshRun(host, `chmod 600 ${shellQuote(paths.repoEnv)}`, { logger });
+  return true;
+}
+async function ensureRemoteRepo(host, service, options = {}) {
+  const { logger = console, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const repo = shellQuote(paths.repo);
+  const repoUrl = shellQuote(service.repoUrl);
+  const root = shellQuote(paths.root);
+  const localKeyBase = deployKey ? (0, import_node_path10.basename)(expandHome2(deployKey)) : null;
+  await ensureDeployKeyOnRemote(host, deployKey, { logger });
+  await prepareGitHost(host, { logger, gitHost: parseGitHost(service.repoUrl), keyBasename: localKeyBase });
+  await sshRun(
+    host,
+    `mkdir -p ${root} && if [ -d ${repo}/.git ]; then git -C ${repo} pull --ff-only; else git clone ${repoUrl} ${repo}; fi`,
+    { logger }
+  );
+  await ensureRepoDependencies(host, service, { logger });
+  await ensureEnvOnRemote(host, service, { logger, envFile });
+}
+async function runRemoteCli(host, service, command, args = [], options = {}) {
+  const { logger = console, manifests, skipPull = false, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  const cli = shellQuote(REMOTE_CLI_REL);
+  if (!skipPull) {
+    await ensureRemoteRepo(host, service, { logger, deployKey, envFile });
+  } else {
+    await ensureRepoDependencies(host, service, { logger });
+    await ensureEnvOnRemote(host, service, { logger, envFile });
+  }
+  const passthrough = [
+    `--service=${service.name}`,
+    ...manifests ? [`--manifests=${manifests}`] : [],
+    ...args
+  ].map(shellQuote).join(" ");
+  await sshRun(host, `cd ${run2} && node ${cli} ${shellQuote(command)} ${passthrough}`.trim(), { logger });
+}
+async function runRemoteStatus(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const port = service.pm2.port;
+  const app = service.pm2.appName;
+  const script = `
+echo "=== apps root ==="
+ls -la ${shellQuote(paths.root)} 2>/dev/null || echo "(missing)"
+echo ""
+echo "=== current ==="
+readlink ${shellQuote(paths.current)} 2>/dev/null || echo "(not set)"
+echo ""
+echo "=== releases ==="
+ls -1 ${shellQuote(paths.releases)} 2>/dev/null || echo "(none)"
+echo ""
+echo "=== pm2 ==="
+pm2 describe ${app} 2>/dev/null | head -20 || pm2 status ${app} 2>/dev/null || echo "(not running)"
+${port ? `echo ""
+echo "=== app health (localhost) ==="
+curl -sf http://127.0.0.1:${port}/healthz 2>/dev/null || echo "(no /healthz on :${port})"` : ""}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+
+// src/deploy/manifests.js
+var import_node_path11 = require("path");
+var import_node_url = require("url");
+async function loadServices({ manifests = "deploy/services.js", cwd = process.cwd() } = {}) {
+  const abs = (0, import_node_path11.isAbsolute)(manifests) ? manifests : (0, import_node_path11.resolve)(cwd, manifests);
+  let mod;
+  try {
+    mod = await import((0, import_node_url.pathToFileURL)(abs).href);
+  } catch (err) {
+    throw new Error(`Could not load deploy manifests from ${abs}: ${err.message}`);
+  }
+  const raw = mod.services ?? mod.default;
+  if (!raw) {
+    throw new Error(`Manifests module ${abs} must export \`services\` (or default): a map or array of service manifests`);
+  }
+  const list = Array.isArray(raw) ? raw : Object.values(raw);
+  const out = {};
+  for (const entry of list) {
+    const svc = defineService(entry);
+    out[svc.name] = svc;
+  }
+  return out;
+}
+function resolveServiceFrom(serviceMap, name, { appsRoot } = {}) {
+  const svc = serviceMap[name];
+  if (!svc) {
+    throw new Error(`Unknown service "${name}". Known: ${Object.keys(serviceMap).join(", ") || "(none)"}`);
+  }
+  return appsRoot ? { ...svc, appsRoot } : svc;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  REMOTE_CLI_REL,
+  activateRelease,
+  appendDeployLog,
+  bootstrapHost,
+  bumpPatchVersion,
+  cloneRepo,
+  createRelease,
+  defineService,
+  deployService,
+  deriveRepoDirName,
+  enableNginxUpstream,
+  ensureDeployKeyOnRemote,
+  ensureEnvOnRemote,
+  ensureRemoteRepo,
+  ensureRepoDependencies,
+  initServiceStructure,
+  installDeps,
+  listReleases,
+  loadServices,
+  npmEnv,
+  npmInstallEnv,
+  parseGitHost,
+  prepareGitHost,
+  provisionService,
+  pruneReleases,
+  pullRepo,
+  readCurrentRelease,
+  readReleaseBuildInfo,
+  releaseDir,
+  releaseStamp,
+  reloadPm2,
+  resolveNextVersion,
+  resolveServiceFrom,
+  rollbackService,
+  run,
+  runReleaseTests,
+  runRemoteCli,
+  runRemoteStatus,
+  runShell,
+  scrubEnvContent,
+  servicePaths,
+  shellQuote,
+  sshRun,
+  syncEnv,
+  writeReleaseBuildInfo
+});
+//# sourceMappingURL=deploy.cjs.map