@nmakarov/cli-toolkit 0.29.0 → 0.33.0

package/dist/deploy.js

@@ -0,0 +1,1096 @@
+// src/deploy/service.js
+function deriveRepoDirName(repoUrl) {
+  const tail = String(repoUrl ?? "").split("/").pop() ?? "repo";
+  return tail.replace(/\.git$/, "") || "repo";
+}
+function defineService(service) {
+  if (!service?.name) throw new Error("service manifest needs a `name`");
+  if (!service.appsRoot) throw new Error(`service "${service.name}" needs an appsRoot`);
+  if (!service.repoUrl) throw new Error(`service "${service.name}" needs a repoUrl`);
+  if (!service.pm2?.script) throw new Error(`service "${service.name}" needs pm2.script`);
+  const pm2 = {
+    appName: service.name,
+    args: "",
+    ...service.pm2
+  };
+  const nginx = service.nginx ? { siteName: service.name, ...service.nginx } : null;
+  return {
+    repoDirName: deriveRepoDirName(service.repoUrl),
+    repoSubdir: "",
+    keepReleases: 3,
+    testCommand: null,
+    envScrubPatterns: [],
+    legacyRepoEnv: null,
+    buildInfoPath: "build-info.json",
+    deployKey: null,
+    requireEnv: false,
+    ...service,
+    pm2,
+    nginx
+  };
+}
+
+// src/deploy/paths.js
+import { join } from "path";
+function servicePaths(service) {
+  const root = service.appsRoot;
+  const repoDirName = service.repoDirName ?? "repo";
+  const repoSubdir = service.repoSubdir ?? "";
+  const repo = join(root, repoDirName);
+  const repoRun = repoSubdir ? join(repo, repoSubdir) : repo;
+  return {
+    root,
+    repo,
+    repoRun,
+    repoEnv: join(repoRun, ".env"),
+    releases: join(root, "releases"),
+    shared: join(root, "shared"),
+    logs: join(root, "logs"),
+    current: join(root, "current"),
+    sharedEnv: join(root, "shared", ".env"),
+    ecosystem: join(root, "shared", "ecosystem.config.cjs"),
+    deployLog: join(root, "logs", "deploy.log"),
+    lockHashFile: join(root, "shared", ".package-lock.sha256")
+  };
+}
+function releaseStamp(date = /* @__PURE__ */ new Date()) {
+  return date.toISOString().replace(/\.\d{3}Z$/, "Z");
+}
+function releaseDir(releasesRoot, stamp) {
+  return join(releasesRoot, stamp);
+}
+
+// src/deploy/run.js
+import { spawn } from "child_process";
+function npmEnv(baseEnv = process.env) {
+  const env = { ...baseEnv };
+  delete env.NODE_ENV;
+  return env;
+}
+function npmInstallEnv(baseEnv = process.env) {
+  return {
+    ...npmEnv(baseEnv),
+    NPM_CONFIG_PRODUCTION: "false",
+    npm_config_production: "false"
+  };
+}
+function run(cmd, args, options = {}) {
+  const { cwd, env, logger } = options;
+  return new Promise((resolve2, reject) => {
+    logger?.info?.(`$ ${cmd} ${args.join(" ")}${cwd ? `  (cwd=${cwd})` : ""}`);
+    const child = spawn(cmd, args, {
+      cwd,
+      env: env ?? process.env,
+      stdio: "inherit"
+    });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code === 0) resolve2();
+      else reject(new Error(`${cmd} exited with code ${code}`));
+    });
+  });
+}
+function runShell(command, options = {}) {
+  return run("bash", ["-lc", command], options);
+}
+
+// src/deploy/log.js
+import { appendFile, mkdir } from "fs/promises";
+async function appendDeployLog(deployLogPath, message) {
+  await mkdir(deployLogPath.replace(/\/[^/]+$/, ""), { recursive: true });
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] ${message}
+`;
+  await appendFile(deployLogPath, line);
+}
+
+// src/deploy/git.js
+import { access } from "fs/promises";
+async function pathExists(path) {
+  try {
+    await access(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function cloneRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (await pathExists(paths.repo)) {
+    throw new Error(`Repo already exists at ${paths.repo} \u2014 use git pull instead`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git clone ${service.repoUrl} ${paths.repo}`);
+    return;
+  }
+  await run("git", ["clone", service.repoUrl, paths.repo], { logger });
+  logger.info(`cloned ${service.repoUrl} \u2192 ${paths.repo}`);
+}
+async function pullRepo(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  if (!await pathExists(paths.repo)) {
+    throw new Error(`Repo missing at ${paths.repo} \u2014 run provision first`);
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would git -C ${paths.repo} pull --ff-only`);
+    return;
+  }
+  await run("git", ["-C", paths.repo, "pull", "--ff-only"], { logger });
+  logger.info(`pulled ${paths.repo}`);
+}
+
+// src/deploy/release.js
+import { cp, mkdir as mkdir2, readlink, readdir, stat } from "fs/promises";
+import { join as join2, dirname as pathDirname, sep } from "path";
+var SKIP_TOP = /* @__PURE__ */ new Set(["node_modules", ".git"]);
+function shouldCopyEntry(srcPath) {
+  const parts = srcPath.split(sep);
+  if (parts.some((p) => p === "node_modules" || p === ".git")) return false;
+  const top = parts.at(-1);
+  if (parts.length === 1 && SKIP_TOP.has(top)) return false;
+  return true;
+}
+async function createRelease(service, options = {}) {
+  const { stamp = releaseStamp(), dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dest = releaseDir(paths.releases, stamp);
+  if (dryRun) {
+    logger.info(`[dryRun] would copy ${paths.repoRun} \u2192 ${dest}`);
+    return { stamp, path: dest };
+  }
+  await mkdir2(paths.releases, { recursive: true });
+  await cp(paths.repoRun, dest, {
+    recursive: true,
+    filter: (src) => shouldCopyEntry(src)
+  });
+  logger.info(`release ${stamp} created at ${dest}`);
+  return { stamp, path: dest };
+}
+async function readCurrentRelease(paths) {
+  try {
+    const target = await readlink(paths.current);
+    return target.startsWith("/") ? target : join2(pathDirname(paths.current), target);
+  } catch {
+    return null;
+  }
+}
+async function listReleases(paths) {
+  let names;
+  try {
+    names = await readdir(paths.releases);
+  } catch {
+    return [];
+  }
+  const entries = [];
+  for (const name of names) {
+    const full = releaseDir(paths.releases, name);
+    const s = await stat(full);
+    if (s.isDirectory()) entries.push({ name, path: full, mtime: s.mtime });
+  }
+  entries.sort((a, b) => b.name.localeCompare(a.name));
+  return entries;
+}
+
+// src/deploy/activate.js
+import { symlink, unlink } from "fs/promises";
+import { join as join3 } from "path";
+async function activateRelease(releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would activate ${releasePath} \u2192 ${paths.current}`);
+    return;
+  }
+  try {
+    await unlink(paths.current);
+  } catch {
+  }
+  await symlink(releasePath, paths.current);
+  const envLink = join3(releasePath, ".env");
+  try {
+    await unlink(envLink);
+  } catch {
+  }
+  await symlink(paths.sharedEnv, envLink);
+  logger.info(`active release: ${releasePath}`);
+}
+
+// src/deploy/deps.js
+import { createHash } from "crypto";
+import { access as access2, cp as cp2, mkdir as mkdir3, readFile, rm, writeFile } from "fs/promises";
+import { join as join4 } from "path";
+async function pathExists2(path) {
+  try {
+    await access2(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function lockfileHash(releasePath) {
+  const lockPath = join4(releasePath, "package-lock.json");
+  try {
+    const buf = await readFile(lockPath);
+    return createHash("sha256").update(buf).digest("hex");
+  } catch {
+    return null;
+  }
+}
+async function readHashFile(path) {
+  try {
+    return (await readFile(path, "utf8")).trim();
+  } catch {
+    return null;
+  }
+}
+async function npmInstall(releasePath, hasLock, logger) {
+  await rm(join4(releasePath, "node_modules"), { recursive: true, force: true });
+  const cmd = hasLock ? ["ci", "--include=dev"] : ["install", "--include=dev", "--no-audit", "--no-fund"];
+  logger.info(`running npm ${cmd.join(" ")} in ${releasePath}`);
+  await run("npm", cmd, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+async function installDeps(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deps in ${releasePath}`);
+    return { hash: null, copied: false };
+  }
+  const hash = await lockfileHash(releasePath);
+  const hasLock = hash !== null;
+  const hashMarker = join4(releasePath, ".deploy-package-lock.sha256");
+  const currentPath = await readCurrentRelease(paths);
+  let copied = false;
+  if (hasLock && currentPath && await pathExists2(join4(currentPath, "node_modules"))) {
+    const currentHash = await readHashFile(join4(currentPath, ".deploy-package-lock.sha256"));
+    if (currentHash === hash) {
+      logger.info("lockfile unchanged \u2014 copying node_modules from current release");
+      await cp2(join4(currentPath, "node_modules"), join4(releasePath, "node_modules"), {
+        recursive: true,
+        force: true
+      });
+      copied = true;
+    }
+  }
+  if (!copied) {
+    await npmInstall(releasePath, hasLock, logger);
+  }
+  if (hasLock) {
+    await writeFile(hashMarker, `${hash}
+`, "utf8");
+    await mkdir3(paths.shared, { recursive: true });
+    await writeFile(paths.lockHashFile, `${hash}
+`, "utf8");
+  }
+  return { hash, copied };
+}
+
+// src/deploy/test.js
+import { symlink as symlink2, unlink as unlink2 } from "fs/promises";
+import { join as join5 } from "path";
+async function runReleaseTests(service, releasePath, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (!service.testCommand) {
+    logger.info("no testCommand configured \u2014 skipping tests");
+    return;
+  }
+  if (dryRun) {
+    logger.info(`[dryRun] would run "${service.testCommand}" in ${releasePath}`);
+    return;
+  }
+  const envLink = join5(releasePath, ".env");
+  try {
+    await unlink2(envLink);
+  } catch {
+  }
+  await symlink2(paths.sharedEnv, envLink);
+  logger.info(`running "${service.testCommand}" in ${releasePath}`);
+  await runShell(service.testCommand, { cwd: releasePath, logger, env: npmInstallEnv() });
+}
+
+// src/deploy/prune.js
+import { rm as rm2, readlink as readlink2 } from "fs/promises";
+async function pruneReleases(service, paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keep = service.keepReleases ?? 3;
+  const releases = await listReleases(paths);
+  let activeName = null;
+  try {
+    const target = await readlink2(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+  }
+  const keepSet = /* @__PURE__ */ new Set();
+  for (const rel of releases) {
+    if (keepSet.size < keep) keepSet.add(rel.name);
+  }
+  if (activeName) keepSet.add(activeName);
+  const toRemove = releases.filter((rel) => !keepSet.has(rel.name));
+  for (const rel of toRemove) {
+    if (dryRun) {
+      logger.info(`[dryRun] would rm -rf ${rel.path}`);
+    } else {
+      await rm2(rel.path, { recursive: true, force: true });
+      logger.info(`pruned ${rel.path}`);
+    }
+  }
+  return { removed: toRemove.map((r) => r.name) };
+}
+
+// src/deploy/pm2.js
+async function reloadPm2(paths, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info(`[dryRun] would pm2 startOrReload ${paths.ecosystem} --update-env`);
+    return;
+  }
+  await runShell(`pm2 startOrReload "${paths.ecosystem}" --update-env`, { logger });
+  logger.info("pm2 reloaded");
+}
+
+// src/deploy/nginx.js
+import { writeFile as writeFile2 } from "fs/promises";
+import { tmpdir } from "os";
+import { join as join6 } from "path";
+async function hasTlsCert(certPath) {
+  try {
+    await runShell(`sudo test -f '${certPath}'`, {});
+    return true;
+  } catch {
+    return false;
+  }
+}
+function proxyBlock(port) {
+  return `  location / {
+    proxy_pass http://127.0.0.1:${port};
+    proxy_http_version 1.1;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 120s;
+  }`;
+}
+function buildNginxConfig(service) {
+  const { nginx, pm2 } = service;
+  const certDir = `/etc/letsencrypt/live/${nginx.fqdn}`;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (proxy mode)
+# ${nginx.fqdn} \u2192 127.0.0.1:${pm2.port}
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+  location / { return 301 https://$host$request_uri; }
+}
+
+server {
+  listen 443 ssl;
+  listen [::]:443 ssl;
+  server_name ${nginx.fqdn};
+
+  ssl_certificate ${certDir}/fullchain.pem;
+  ssl_certificate_key ${certDir}/privkey.pem;
+  include /etc/letsencrypt/options-ssl-nginx.conf;
+  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+function buildNginxConfigHttpOnly(service) {
+  const { nginx, pm2 } = service;
+  return `# ${nginx.siteName} \u2014 managed by cli-toolkit deploy (HTTP proxy, no TLS cert yet)
+
+server {
+  listen 80;
+  listen [::]:80;
+  server_name ${nginx.fqdn};
+
+  client_max_body_size 25m;
+
+${proxyBlock(pm2.port)}
+}
+`;
+}
+async function enableNginxUpstream(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const { nginx } = service;
+  if (!nginx) {
+    logger.info("no nginx config on service \u2014 skipping nginx step");
+    return { skipped: true };
+  }
+  const siteAvailable = `/etc/nginx/sites-available/${nginx.siteName}`;
+  const siteEnabled = `/etc/nginx/sites-enabled/${nginx.siteName}`;
+  const cert = `/etc/letsencrypt/live/${nginx.fqdn}/fullchain.pem`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${siteAvailable} (proxy \u2192 127.0.0.1:${service.pm2.port}) and reload nginx`);
+    return { hasCert: null };
+  }
+  const hasCert = await hasTlsCert(cert);
+  const config = hasCert ? buildNginxConfig(service) : buildNginxConfigHttpOnly(service);
+  const tmp = join6(tmpdir(), `${service.name}-nginx.conf`);
+  await writeFile2(tmp, config);
+  await runShell(
+    `sudo cp '${tmp}' '${siteAvailable}' && sudo ln -sf '${siteAvailable}' '${siteEnabled}' && sudo nginx -t && sudo systemctl reload nginx`,
+    { logger }
+  );
+  logger.info(`nginx upstream enabled for ${nginx.fqdn} \u2192 127.0.0.1:${service.pm2.port} (tls=${hasCert})`);
+  return { hasCert };
+}
+
+// src/deploy/sync-env.js
+import { access as access3, mkdir as mkdir4, readFile as readFile2, writeFile as writeFile3 } from "fs/promises";
+function scrubEnvContent(content, patterns = []) {
+  const regexes = patterns.map((p) => p instanceof RegExp ? p : new RegExp(p));
+  if (regexes.length === 0) return content;
+  return content.split("\n").filter((line) => !regexes.some((re) => re.test(line.trim()))).join("\n");
+}
+async function pathExists3(path) {
+  try {
+    await access3(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function syncEnv(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const patterns = service.envScrubPatterns ?? [];
+  if (dryRun) {
+    logger.info(`[dryRun] would sync ${paths.repoEnv} \u2192 ${paths.sharedEnv}`);
+    return { source: paths.repoEnv, dest: paths.sharedEnv };
+  }
+  let source = paths.repoEnv;
+  if (!await pathExists3(source) && service.legacyRepoEnv && await pathExists3(service.legacyRepoEnv)) {
+    logger.info(`using legacy env: ${service.legacyRepoEnv}`);
+    source = service.legacyRepoEnv;
+  }
+  await mkdir4(paths.shared, { recursive: true });
+  if (!await pathExists3(source)) {
+    if (service.requireEnv) {
+      throw new Error(
+        `No .env found at ${paths.repoEnv}` + (service.legacyRepoEnv ? ` or ${service.legacyRepoEnv}` : "") + " \u2014 place .env on the host or run the remote deploy from a laptop with a local .env (auto-scp)"
+      );
+    }
+    if (!await pathExists3(paths.sharedEnv)) {
+      await writeFile3(paths.sharedEnv, "", { mode: 384 });
+    }
+    logger.warn(`no .env found (source ${source}) \u2014 using empty ${paths.sharedEnv}`);
+    return { source: null, dest: paths.sharedEnv };
+  }
+  const raw = await readFile2(source, "utf8");
+  await writeFile3(paths.sharedEnv, scrubEnvContent(raw, patterns), { mode: 384 });
+  logger.info(`synced ${source} \u2192 ${paths.sharedEnv}`);
+  return { source, dest: paths.sharedEnv };
+}
+
+// src/deploy/build-info.js
+import { readFile as readFile3, writeFile as writeFile4, mkdir as mkdir5 } from "fs/promises";
+import { join as join7, dirname } from "path";
+import { execFile } from "child_process";
+import { promisify } from "util";
+var execFileAsync = promisify(execFile);
+function bumpPatchVersion(version) {
+  const parts = String(version).trim().split(".");
+  const major = Number.parseInt(parts[0], 10) || 0;
+  const minor = Number.parseInt(parts[1], 10) || 0;
+  const patch = Number.parseInt(parts[2], 10) || 0;
+  return `${major}.${minor}.${patch + 1}`;
+}
+async function readJson(path) {
+  try {
+    return JSON.parse(await readFile3(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+async function gitShortCommit(repoPath) {
+  try {
+    const { stdout } = await execFileAsync("git", ["-C", repoPath, "rev-parse", "--short", "HEAD"], {
+      encoding: "utf8"
+    });
+    return stdout.trim() || null;
+  } catch {
+    return null;
+  }
+}
+async function resolveNextVersion(service, paths, pkgPath) {
+  const pkg = await readJson(pkgPath) ?? {};
+  const baseVersion = pkg.version || "0.1.0";
+  const currentPath = await readCurrentRelease(paths);
+  if (currentPath) {
+    const active = await readJson(join7(currentPath, service.buildInfoPath));
+    if (active?.version) return bumpPatchVersion(active.version);
+  }
+  return baseVersion;
+}
+async function readReleaseBuildInfo(service, releasePath) {
+  return readJson(join7(releasePath, service.buildInfoPath));
+}
+async function writeReleaseBuildInfo(service, releasePath, { stamp, dryRun = false, logger = console }) {
+  const paths = servicePaths(service);
+  const pkgPath = join7(paths.repoRun, "package.json");
+  const version = await resolveNextVersion(service, paths, pkgPath);
+  const gitCommit = await gitShortCommit(paths.repo);
+  const buildInfo = {
+    version,
+    release: stamp,
+    deployedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    gitCommit,
+    service: service.name
+  };
+  const dest = join7(releasePath, service.buildInfoPath);
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${dest} (${JSON.stringify(buildInfo)})`);
+    return buildInfo;
+  }
+  await mkdir5(dirname(dest), { recursive: true });
+  await writeFile4(dest, `${JSON.stringify(buildInfo, null, 2)}
+`, { mode: 420 });
+  const gitSuffix = gitCommit ? ` git=${gitCommit}` : "";
+  logger.info(`build info: v${version} release=${stamp}${gitSuffix}`);
+  return buildInfo;
+}
+
+// src/deploy/init-structure.js
+import { access as access4, appendFile as appendFile2, mkdir as mkdir6, writeFile as writeFile5 } from "fs/promises";
+import { dirname as dirname2, join as join8 } from "path";
+async function pathExists4(path) {
+  try {
+    await access4(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function requireDeployRoot(parentDir, serviceRoot) {
+  if (await pathExists4(parentDir)) return;
+  throw new Error(
+    `Cannot create ${serviceRoot}: parent directory ${parentDir} does not exist.
+This is meant to run on the target host (where ${parentDir} exists). For a local dry run use --appsRoot=/tmp/<service>.`
+  );
+}
+function buildEcosystemConfig(service, paths) {
+  const { pm2 } = service;
+  const outLog = join8(paths.logs, `${pm2.appName}.out.log`);
+  const errLog = join8(paths.logs, `${pm2.appName}.err.log`);
+  return `/**
+ * pm2 ecosystem for ${service.name} \u2014 seeded by cli-toolkit deploy (init).
+ *
+ * cwd points at the \`current\` symlink (created on first deploy).
+ * Tweak \`args\` here, then: pm2 reload ${paths.ecosystem} --update-env
+ */
+module.exports = {
+    apps: [
+        {
+            name: "${pm2.appName}",
+            script: "${pm2.script}",
+            cwd: "${paths.current}",
+            args: "${pm2.args}",
+            instances: 1,
+            exec_mode: "fork",
+            autorestart: true,
+            min_uptime: "10s",
+            max_restarts: 10,
+            restart_delay: 2000,
+            max_memory_restart: "1500M",
+            out_file: "${outLog}",
+            error_file: "${errLog}",
+            merge_logs: true,
+            time: true,
+            env: {
+                NODE_ENV: "production",
+            },
+        },
+    ],
+};
+`;
+}
+async function initServiceStructure(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const dirs = [paths.releases, paths.shared, paths.logs];
+  const created = [];
+  const skipped = [];
+  if (!dryRun) {
+    await requireDeployRoot(dirname2(paths.root), paths.root);
+  }
+  for (const dir of dirs) {
+    if (await pathExists4(dir)) {
+      skipped.push(dir);
+      continue;
+    }
+    if (!dryRun) await mkdir6(dir, { recursive: true });
+    created.push(dir);
+  }
+  let ecosystemCreated = false;
+  if (await pathExists4(paths.ecosystem)) {
+    skipped.push(paths.ecosystem);
+  } else {
+    if (!dryRun) {
+      await writeFile5(paths.ecosystem, buildEcosystemConfig(service, paths), { mode: 420 });
+    }
+    ecosystemCreated = true;
+    created.push(paths.ecosystem);
+  }
+  const line = `[${(/* @__PURE__ */ new Date()).toISOString()}] init-structure service=${service.name} dryRun=${dryRun} created=${created.length} skipped=${skipped.length}
+`;
+  if (!dryRun) {
+    await mkdir6(paths.logs, { recursive: true });
+    await appendFile2(paths.deployLog, line);
+  }
+  logger.info(`service=${service.name} appsRoot=${paths.root}`);
+  logger.info(`created: ${created.length ? created.join(", ") : "(none)"}`);
+  logger.info(`already present: ${skipped.length ? skipped.join(", ") : "(none)"}`);
+  if (ecosystemCreated) logger.info(`seeded ${paths.ecosystem}`);
+  return { paths, created, skipped, ecosystemCreated };
+}
+
+// src/deploy/bootstrap-host.js
+import { execSync } from "child_process";
+import { access as access5, chmod, copyFile, mkdir as mkdir7, readFile as readFile4, writeFile as writeFile6 } from "fs/promises";
+import { homedir } from "os";
+import { basename, join as join9 } from "path";
+async function pathExists5(path) {
+  try {
+    await access5(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome(path) {
+  return path.startsWith("~/") ? join9(homedir(), path.slice(2)) : path;
+}
+async function ensurePm2Startup(options = {}) {
+  const { user = "ubuntu", dryRun = false, logger = console } = options;
+  if (dryRun) {
+    logger.info("[dryRun] would configure pm2 startup systemd");
+    return;
+  }
+  try {
+    execSync("pm2 ping", { stdio: "ignore" });
+  } catch {
+  }
+  try {
+    const out = execSync(`pm2 startup systemd -u ${user} --hp /home/${user}`, { encoding: "utf8" });
+    const sudoLine = out.split("\n").find((l) => l.trim().startsWith("sudo"));
+    if (sudoLine) {
+      execSync(sudoLine.trim(), { stdio: "inherit" });
+      logger.info("pm2 startup systemd configured");
+    }
+  } catch (err) {
+    logger.warn(`pm2 startup skipped or already configured: ${err.message}`);
+  }
+}
+async function installDeployKey(deployKeyPath, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const keyPath = expandHome(deployKeyPath);
+  if (!await pathExists5(keyPath)) {
+    logger.warn(`deploy key not found at ${keyPath} \u2014 skipping git ssh setup`);
+    return;
+  }
+  const keyBase = basename(keyPath);
+  const sshDir = join9(homedir(), ".ssh");
+  const destKey = join9(sshDir, keyBase);
+  const configPath = join9(sshDir, "config");
+  const block = `
+Host github.com
+  HostName github.com
+  User git
+  IdentityFile ${destKey}
+  IdentitiesOnly yes
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would install deploy key ${keyPath} \u2192 ${destKey}`);
+    return;
+  }
+  await mkdir7(sshDir, { recursive: true, mode: 448 });
+  await copyFile(keyPath, destKey);
+  await chmod(destKey, 384);
+  let config = "";
+  if (await pathExists5(configPath)) config = await readFile4(configPath, "utf8");
+  if (!config.includes("Host github.com")) {
+    await writeFile6(configPath, `${config.trimEnd()}
+${block}
+`, { mode: 384 });
+    logger.info("updated ~/.ssh/config for github.com");
+  }
+  logger.info(`deploy key installed at ${destKey}`);
+}
+async function installLogrotate(service, options = {}) {
+  const { dryRun = false, logger = console } = options;
+  const conf = `/etc/logrotate.d/${service.name}`;
+  const body = `${service.appsRoot}/logs/*.log {
+  daily
+  rotate 14
+  compress
+  delaycompress
+  missingok
+  notifempty
+  copytruncate
+}
+`;
+  if (dryRun) {
+    logger.info(`[dryRun] would write ${conf}`);
+    return;
+  }
+  const tmp = join9("/tmp", `${service.name}-logrotate.conf`);
+  await writeFile6(tmp, body);
+  await runShell(`sudo cp '${tmp}' '${conf}'`, { logger });
+  logger.info(`logrotate config written: ${conf}`);
+}
+async function bootstrapHost(service, options = {}) {
+  const { deployKey = service.deployKey, user = "ubuntu", dryRun = false, logger = console } = options;
+  await ensurePm2Startup({ user, dryRun, logger });
+  if (deployKey) await installDeployKey(deployKey, { dryRun, logger });
+  await installLogrotate(service, { dryRun, logger });
+  logger.info("bootstrap-host complete");
+}
+
+// src/deploy/deploy-service.js
+async function deployService(service, options = {}) {
+  const {
+    dryRun = false,
+    skipPull = false,
+    skipTests = false,
+    skipNginx = false,
+    logger = console
+  } = options;
+  const paths = servicePaths(service);
+  await initServiceStructure(service, { dryRun, logger });
+  if (!skipPull) await pullRepo(service, { dryRun, logger });
+  await syncEnv(service, { dryRun, logger });
+  const { stamp, path: releasePath } = await createRelease(service, { dryRun, logger });
+  await writeReleaseBuildInfo(service, releasePath, { stamp, dryRun, logger });
+  await installDeps(service, releasePath, paths, { dryRun, logger });
+  if (!skipTests) await runReleaseTests(service, releasePath, paths, { dryRun, logger });
+  await activateRelease(releasePath, paths, { dryRun, logger });
+  await pruneReleases(service, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  if (!skipNginx) await enableNginxUpstream(service, { dryRun, logger });
+  const summary = `deploy complete stamp=${stamp} dryRun=${dryRun}`;
+  logger.info(summary);
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { stamp, releasePath };
+}
+
+// src/deploy/provision-service.js
+import { access as access6 } from "fs/promises";
+async function pathExists6(path) {
+  try {
+    await access6(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function provisionService(service, options = {}) {
+  const {
+    dryRun = false,
+    deploy = true,
+    skipBootstrap = true,
+    deployKey,
+    logger = console
+  } = options;
+  if (!skipBootstrap) {
+    await bootstrapHost(service, { deployKey, dryRun, logger });
+  }
+  await initServiceStructure(service, { dryRun, logger });
+  const paths = servicePaths(service);
+  if (await pathExists6(paths.repo)) {
+    logger.info(`repo exists at ${paths.repo} \u2014 pulling`);
+    await pullRepo(service, { dryRun, logger });
+  } else {
+    await cloneRepo(service, { dryRun, logger });
+  }
+  await syncEnv(service, { dryRun, logger });
+  if (deploy) {
+    await deployService(service, { dryRun, logger, skipPull: true });
+  } else {
+    logger.info("provision complete (deploy skipped)");
+  }
+}
+
+// src/deploy/rollback-service.js
+import { readlink as readlink3 } from "fs/promises";
+async function rollbackService(service, options = {}) {
+  const { release: targetName, dryRun = false, logger = console } = options;
+  const paths = servicePaths(service);
+  const releases = await listReleases(paths);
+  if (releases.length === 0) throw new Error("No releases to roll back to");
+  let activeName = null;
+  try {
+    const target = await readlink3(paths.current);
+    activeName = target.split("/").pop();
+  } catch {
+    throw new Error("No active release (current symlink missing)");
+  }
+  let rollbackTarget;
+  if (targetName) {
+    rollbackTarget = releases.find((r) => r.name === targetName);
+    if (!rollbackTarget) throw new Error(`Release not found: ${targetName}`);
+  } else {
+    rollbackTarget = releases.find((r) => r.name !== activeName);
+    if (!rollbackTarget) throw new Error("No previous release to roll back to");
+  }
+  if (rollbackTarget.name === activeName) throw new Error(`Already on release ${activeName}`);
+  logger.info(`rollback ${activeName} \u2192 ${rollbackTarget.name}`);
+  const buildInfo = await readReleaseBuildInfo(service, rollbackTarget.path);
+  if (buildInfo?.version) {
+    logger.info(`rollback target: v${buildInfo.version} release=${buildInfo.release ?? rollbackTarget.name}`);
+  }
+  await activateRelease(rollbackTarget.path, paths, { dryRun, logger });
+  await reloadPm2(paths, { dryRun, logger });
+  const summary = `rollback ${activeName} \u2192 ${rollbackTarget.name} dryRun=${dryRun}`;
+  if (!dryRun) await appendDeployLog(paths.deployLog, summary);
+  return { from: activeName, to: rollbackTarget.name, path: rollbackTarget.path };
+}
+
+// src/deploy/ssh-remote.js
+import { access as access7, readFile as readFile5, writeFile as writeFile7 } from "fs/promises";
+import { homedir as homedir2, tmpdir as tmpdir2 } from "os";
+import { basename as basename2, dirname as dirname3, join as join10 } from "path";
+import { spawn as spawn2 } from "child_process";
+var REMOTE_CLI_REL = "node_modules/@nmakarov/cli-toolkit/scripts/deploy/cli.js";
+async function pathExists7(path) {
+  try {
+    await access7(path);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function expandHome2(path) {
+  return path.startsWith("~/") ? join10(homedir2(), path.slice(2)) : path;
+}
+function resolveLocalEnvPath(envFile) {
+  if (envFile) {
+    const expanded = expandHome2(envFile);
+    return expanded.startsWith("/") ? expanded : join10(process.cwd(), expanded);
+  }
+  return join10(process.cwd(), ".env");
+}
+function parseGitHost(repoUrl) {
+  const u = String(repoUrl ?? "");
+  let m = u.match(/^[^@]+@([^:]+):/);
+  if (m) return m[1];
+  m = u.match(/^ssh:\/\/[^@]+@([^/:]+)/);
+  if (m) return m[1];
+  return null;
+}
+function shellQuote(value) {
+  return `'${String(value).replace(/'/g, `'\\''`)}'`;
+}
+function sshRun(host, remoteCommand, options = {}) {
+  const { logger } = options;
+  return new Promise((resolve2, reject) => {
+    logger?.info?.(`ssh ${host} ${remoteCommand.slice(0, 120)}${remoteCommand.length > 120 ? "\u2026" : ""}`);
+    const child = spawn2("ssh", [host, remoteCommand], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve2() : reject(new Error(`ssh ${host} exited with code ${code}`)));
+  });
+}
+function scp(localPath, remoteSpec) {
+  return new Promise((resolve2, reject) => {
+    const child = spawn2("scp", [localPath, remoteSpec], { stdio: "inherit" });
+    child.on("error", reject);
+    child.on("close", (code) => code === 0 ? resolve2() : reject(new Error(`scp exited with code ${code}`)));
+  });
+}
+async function ensureDeployKeyOnRemote(host, deployKeyPath, options = {}) {
+  const { logger = console } = options;
+  if (!deployKeyPath) return false;
+  const localPath = expandHome2(deployKeyPath);
+  if (!await pathExists7(localPath)) return false;
+  const keyBase = basename2(localPath);
+  logger.info(`copying deploy key ${localPath} \u2192 ${host}:~/.ssh/${keyBase}`);
+  await sshRun(host, "mkdir -p ~/.ssh && chmod 700 ~/.ssh", { logger });
+  await scp(localPath, `${host}:.ssh/${keyBase}`, { logger });
+  await sshRun(host, `chmod 600 ~/.ssh/${keyBase}`, { logger });
+  return true;
+}
+async function prepareGitHost(host, options = {}) {
+  const { logger = console, gitHost, keyBasename } = options;
+  if (!gitHost) return;
+  const configBlock = keyBasename ? `if ! grep -q 'Host ${gitHost}' ~/.ssh/config 2>/dev/null; then
+  printf '%s\\n' '' 'Host ${gitHost}' '  HostName ${gitHost}' '  User git' '  IdentityFile ~/.ssh/${keyBasename}' '  IdentitiesOnly yes' >> ~/.ssh/config
+  chmod 600 ~/.ssh/config
+  echo "configured ~/.ssh/config for ${gitHost}"
+fi` : `:`;
+  const script = `
+set -euo pipefail
+mkdir -p ~/.ssh
+chmod 700 ~/.ssh
+if ! grep -q '^${gitHost}' ~/.ssh/known_hosts 2>/dev/null; then
+  ssh-keyscan -t ed25519,rsa ${gitHost} >> ~/.ssh/known_hosts 2>/dev/null
+  echo "added ${gitHost} to known_hosts"
+fi
+${configBlock}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+async function ensureRepoDependencies(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  await sshRun(
+    host,
+    `cd ${run2} && if [ ! -d node_modules/@nmakarov/cli-toolkit ] || [ package-lock.json -nt node_modules/.package-lock.json ]; then npm ci; fi`,
+    { logger }
+  );
+}
+async function ensureEnvOnRemote(host, service, options = {}) {
+  const { logger = console, envFile } = options;
+  const paths = servicePaths(service);
+  const localPath = resolveLocalEnvPath(envFile);
+  if (!await pathExists7(localPath)) return false;
+  logger.info(`copying .env ${localPath} \u2192 ${host}:${paths.repoEnv}`);
+  await sshRun(host, `mkdir -p ${shellQuote(dirname3(paths.repoEnv))}`, { logger });
+  const scrubbed = scrubEnvContent(await readFile5(localPath, "utf8"), service.envScrubPatterns ?? []);
+  const tmp = join10(tmpdir2(), `deploy-env-${Date.now()}`);
+  await writeFile7(tmp, scrubbed, { mode: 384 });
+  await scp(tmp, `${host}:${paths.repoEnv}`, { logger });
+  await sshRun(host, `chmod 600 ${shellQuote(paths.repoEnv)}`, { logger });
+  return true;
+}
+async function ensureRemoteRepo(host, service, options = {}) {
+  const { logger = console, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const repo = shellQuote(paths.repo);
+  const repoUrl = shellQuote(service.repoUrl);
+  const root = shellQuote(paths.root);
+  const localKeyBase = deployKey ? basename2(expandHome2(deployKey)) : null;
+  await ensureDeployKeyOnRemote(host, deployKey, { logger });
+  await prepareGitHost(host, { logger, gitHost: parseGitHost(service.repoUrl), keyBasename: localKeyBase });
+  await sshRun(
+    host,
+    `mkdir -p ${root} && if [ -d ${repo}/.git ]; then git -C ${repo} pull --ff-only; else git clone ${repoUrl} ${repo}; fi`,
+    { logger }
+  );
+  await ensureRepoDependencies(host, service, { logger });
+  await ensureEnvOnRemote(host, service, { logger, envFile });
+}
+async function runRemoteCli(host, service, command, args = [], options = {}) {
+  const { logger = console, manifests, skipPull = false, deployKey = service.deployKey, envFile } = options;
+  const paths = servicePaths(service);
+  const run2 = shellQuote(paths.repoRun);
+  const cli = shellQuote(REMOTE_CLI_REL);
+  if (!skipPull) {
+    await ensureRemoteRepo(host, service, { logger, deployKey, envFile });
+  } else {
+    await ensureRepoDependencies(host, service, { logger });
+    await ensureEnvOnRemote(host, service, { logger, envFile });
+  }
+  const passthrough = [
+    `--service=${service.name}`,
+    ...manifests ? [`--manifests=${manifests}`] : [],
+    ...args
+  ].map(shellQuote).join(" ");
+  await sshRun(host, `cd ${run2} && node ${cli} ${shellQuote(command)} ${passthrough}`.trim(), { logger });
+}
+async function runRemoteStatus(host, service, options = {}) {
+  const { logger = console } = options;
+  const paths = servicePaths(service);
+  const port = service.pm2.port;
+  const app = service.pm2.appName;
+  const script = `
+echo "=== apps root ==="
+ls -la ${shellQuote(paths.root)} 2>/dev/null || echo "(missing)"
+echo ""
+echo "=== current ==="
+readlink ${shellQuote(paths.current)} 2>/dev/null || echo "(not set)"
+echo ""
+echo "=== releases ==="
+ls -1 ${shellQuote(paths.releases)} 2>/dev/null || echo "(none)"
+echo ""
+echo "=== pm2 ==="
+pm2 describe ${app} 2>/dev/null | head -20 || pm2 status ${app} 2>/dev/null || echo "(not running)"
+${port ? `echo ""
+echo "=== app health (localhost) ==="
+curl -sf http://127.0.0.1:${port}/healthz 2>/dev/null || echo "(no /healthz on :${port})"` : ""}
+`.trim();
+  await sshRun(host, script, { logger });
+}
+
+// src/deploy/manifests.js
+import { isAbsolute, resolve } from "path";
+import { pathToFileURL } from "url";
+async function loadServices({ manifests = "deploy/services.js", cwd = process.cwd() } = {}) {
+  const abs = isAbsolute(manifests) ? manifests : resolve(cwd, manifests);
+  let mod;
+  try {
+    mod = await import(pathToFileURL(abs).href);
+  } catch (err) {
+    throw new Error(`Could not load deploy manifests from ${abs}: ${err.message}`);
+  }
+  const raw = mod.services ?? mod.default;
+  if (!raw) {
+    throw new Error(`Manifests module ${abs} must export \`services\` (or default): a map or array of service manifests`);
+  }
+  const list = Array.isArray(raw) ? raw : Object.values(raw);
+  const out = {};
+  for (const entry of list) {
+    const svc = defineService(entry);
+    out[svc.name] = svc;
+  }
+  return out;
+}
+function resolveServiceFrom(serviceMap, name, { appsRoot } = {}) {
+  const svc = serviceMap[name];
+  if (!svc) {
+    throw new Error(`Unknown service "${name}". Known: ${Object.keys(serviceMap).join(", ") || "(none)"}`);
+  }
+  return appsRoot ? { ...svc, appsRoot } : svc;
+}
+export {
+  REMOTE_CLI_REL,
+  activateRelease,
+  appendDeployLog,
+  bootstrapHost,
+  bumpPatchVersion,
+  cloneRepo,
+  createRelease,
+  defineService,
+  deployService,
+  deriveRepoDirName,
+  enableNginxUpstream,
+  ensureDeployKeyOnRemote,
+  ensureEnvOnRemote,
+  ensureRemoteRepo,
+  ensureRepoDependencies,
+  initServiceStructure,
+  installDeps,
+  listReleases,
+  loadServices,
+  npmEnv,
+  npmInstallEnv,
+  parseGitHost,
+  prepareGitHost,
+  provisionService,
+  pruneReleases,
+  pullRepo,
+  readCurrentRelease,
+  readReleaseBuildInfo,
+  releaseDir,
+  releaseStamp,
+  reloadPm2,
+  resolveNextVersion,
+  resolveServiceFrom,
+  rollbackService,
+  run,
+  runReleaseTests,
+  runRemoteCli,
+  runRemoteStatus,
+  runShell,
+  scrubEnvContent,
+  servicePaths,
+  shellQuote,
+  sshRun,
+  syncEnv,
+  writeReleaseBuildInfo
+};
+//# sourceMappingURL=deploy.js.map