@omega.js/manager 0.1.0

package/dist/lib/service-runner.js

@@ -0,0 +1,466 @@
+/**
+ * Service Runner — shared library for running service operations. Ported from
+ * omega-manager's src/lib/service-runner.js with the SAME strict contract so
+ * services port over without semantic drift.
+ *
+ * All services use this same pattern:
+ * 1. Operations are declared in src/config.js OPERATIONS[serviceName]
+ * 2. Handlers live in ensure/, read/, transform/, write/ directories
+ * 3. This runner loads and executes handlers in operation order
+ *
+ * @example
+ * // In src/services/my-service/index.js
+ * const { createServiceRunner } = require('../../lib/service-runner.js');
+ * module.exports.run = createServiceRunner({ serviceDir: __dirname });
+ *
+ * @example
+ * // With custom setup/hooks
+ * module.exports.run = createServiceRunner({
+ *   serviceDir: __dirname,
+ *   setup: (context) => {
+ *     if (!context.brandConfig.myService) {
+ *       return { skip: true, reason: 'no config' };
+ *     }
+ *     return { api: new MyAPI() };
+ *   },
+ * });
+ */
+
+const fs = require('node:fs');
+const { join } = require('node:path');
+const chalk = require('chalk').default;
+
+const { needsInteractiveSkip } = require('./run-gates.js');
+const { CONSENT_REQUIRED } = require('./google-auth.js');
+
+/**
+ * Class a caught error (#228): a consent gate is a pending HUMAN step, not a
+ * failure — it becomes the warned step-aside the run summary's ⚑ section
+ * names, so the walk (and an `omega dev` boot on top of it) continues.
+ * Everything else stays loud.
+ *
+ * @param {Error} error - The caught error.
+ * @param {string} operationName - The operation's output key.
+ * @returns {object|null} The needsInteractiveSkip return, or null when the
+ *   error is a real failure.
+ */
+function pendingGate(error, operationName) {
+  if (error?.code !== CONSENT_REQUIRED) {
+    return null;
+  }
+
+  console.log(`      ${chalk.yellow('⚑')} Needs an interactive run${chalk.dim(`: ${error.message}`)}`);
+  return needsInteractiveSkip(operationName, error.message);
+}
+
+/**
+ * Load an operation handler from a service directory.
+ *
+ * Missing handler file → null (the runner logs and continues). A handler file
+ * that EXISTS but fails to require throws loudly — omega-manager's message
+ * sniffing silently swallowed broken handlers; existence-check-first doesn't.
+ *
+ * @param {string} serviceDir - Absolute path to service directory
+ * @param {string} operationName - Name of the operation (e.g., 'targets')
+ * @param {string} type - Handler type ('ensure', 'read', 'transform', 'write')
+ * @returns {Function|null} - Handler function or null if not found
+ */
+function getOperationHandler(serviceDir, operationName, type) {
+  const modulePath = join(serviceDir, type, `${operationName}.js`);
+
+  if (!fs.existsSync(modulePath)) {
+    return null;
+  }
+
+  const module = require(modulePath);
+  return module.default || module || null;
+}
+
+/**
+ * Split a handler return into the within-run carry vs transient output.
+ *
+ * STRICT contract — handler returns MUST be one of:
+ *   - undefined / null                              → no-op
+ *   - { state: {...} }                              → carry only (this run's serviceData, never a file)
+ *   - { output: {...} }                             → transient only (lands in .omega/runs/{ts}.json)
+ *   - { state, output }                             → both
+ *   - { status, error?, reason?, state?, output? }  → status/error/reason are metadata, allowed alongside state/output
+ *
+ * Any other top-level key throws. This prevents accidental data leakage into
+ * the carry via an "everything dumps to serviceData" pattern.
+ *
+ * `state` is the LATER-OPERATIONS channel and nothing more (#434 retired the
+ * .omega/state.json cache): a value a following operation in the same service needs
+ * (the zone id, the bundle id, the Sentry project map). A fact that must
+ * OUTLIVE the run belongs in config/omega.json5 via lib/config-write.js — or
+ * in the brand .env via lib/env-secret.js when it is secret-shaped. Anything
+ * else (counts, success/fail flags, "what happened this run") goes to `output`.
+ */
+const ALLOWED_KEYS = new Set(['state', 'output', 'status', 'error', 'reason']);
+
+function splitReturn(result, operationName = 'unknown') {
+  if (result === undefined || result === null) {
+    return { state: null, output: null };
+  }
+  if (typeof result !== 'object' || Array.isArray(result)) {
+    throw new Error(
+      `Handler "${operationName}" returned ${Array.isArray(result) ? 'an array' : typeof result}. `
+      + `Returns must be undefined or an object with shape { state?, output?, status?, error?, reason? }.`,
+    );
+  }
+
+  const keys = Object.keys(result);
+  const invalidKeys = keys.filter((k) => !ALLOWED_KEYS.has(k));
+  if (invalidKeys.length > 0) {
+    throw new Error(
+      `Handler "${operationName}" returned invalid top-level key(s): ${invalidKeys.join(', ')}. `
+      + `Allowed keys: state, output, status, error, reason. `
+      + `Wrap durable IDs in { state: {...} } and transient flags/counts in { output: {...} }.`,
+    );
+  }
+
+  return {
+    state: 'state' in result ? result.state : null,
+    output: 'output' in result ? result.output : null,
+  };
+}
+
+/**
+ * Run ensure operation
+ */
+async function runEnsure(serviceDir, operation, context, accumulators) {
+  const handler = getOperationHandler(serviceDir, operation.name, 'ensure');
+
+  if (!handler) {
+    console.log(`      ${chalk.yellow('⚠')} No ensure handler for ${chalk.bold(operation.name)}`);
+    return { status: 'continue' };
+  }
+
+  try {
+    // serviceData passed to handler = merged state + output (so handlers can read previous handler state)
+    const result = await handler({ ...context, serviceData: { ...accumulators.state, ...accumulators.output } });
+
+    const { state, output } = splitReturn(result, operation.name);
+    if (state) Object.assign(accumulators.state, state);
+    if (output) Object.assign(accumulators.output, output);
+
+    // Status check on the raw handler return
+    if (result?.status === 'error') return { status: 'error', error: result.error };
+    if (result?.status === 'warned') return { status: 'warned', reason: result.reason };
+
+    return { status: 'continue' };
+  } catch (error) {
+    const pending = pendingGate(error, operation.name);
+    if (pending) {
+      Object.assign(accumulators.output, pending.output);
+      return { status: 'warned', reason: pending.reason };
+    }
+
+    console.error(`      ${chalk.red('❌')} Ensure failed${chalk.dim(`: ${error.message}`)}`);
+    return { status: 'error', error: error.message };
+  }
+}
+
+/**
+ * Run read operation
+ */
+async function runRead(serviceDir, operation, context, serviceData) {
+  const handler = getOperationHandler(serviceDir, operation.name, 'read');
+
+  if (!handler) {
+    return { data: null, status: 'continue' };
+  }
+
+  try {
+    const result = await handler({ ...context, serviceData });
+
+    if (result?.count !== undefined) {
+      console.log(`      ${chalk.green('✓')} Read ${chalk.dim(`(${result.count} items)`)}`);
+    } else {
+      console.log(`      ${chalk.green('✓')} Read`);
+    }
+
+    return { data: result, status: 'continue' };
+  } catch (error) {
+    const pending = pendingGate(error, operation.name);
+    if (pending) {
+      // No accumulators here — the caller merges the marker
+      return { data: null, status: 'warned', output: pending.output, reason: pending.reason };
+    }
+
+    console.error(`      ${chalk.red('❌')} Read failed${chalk.dim(`: ${error.message}`)}`);
+    return { data: null, status: 'error' };
+  }
+}
+
+/**
+ * Run transform operation
+ */
+async function runTransform(serviceDir, operation, context, serviceData, readData) {
+  const handler = getOperationHandler(serviceDir, operation.name, 'transform');
+
+  if (!handler) {
+    return { data: readData, status: 'continue' };
+  }
+
+  try {
+    const result = await handler({ ...context, serviceData, readData });
+
+    if (!result) {
+      console.log(`      ${chalk.dim('⊘ No changes needed')}`);
+      return { data: null, status: 'skip' };
+    }
+
+    console.log(`      ${chalk.green('✓')} Transform`);
+    return { data: result, status: 'continue' };
+  } catch (error) {
+    const pending = pendingGate(error, operation.name);
+    if (pending) {
+      return { data: null, status: 'warned', output: pending.output, reason: pending.reason };
+    }
+
+    console.error(`      ${chalk.red('❌')} Transform failed${chalk.dim(`: ${error.message}`)}`);
+    return { data: null, status: 'error' };
+  }
+}
+
+/**
+ * Run write operation
+ */
+async function runWrite(serviceDir, operation, context, accumulators, data) {
+  const handler = getOperationHandler(serviceDir, operation.name, 'write');
+
+  if (!handler) {
+    console.log(`      ${chalk.yellow('⚠')} No write handler for ${chalk.bold(operation.name)}`);
+    return { status: 'continue' };
+  }
+
+  try {
+    const result = await handler({
+      ...context,
+      serviceData: { ...accumulators.state, ...accumulators.output },
+      data,
+    });
+
+    console.log(`      ${chalk.green('✓')} Write`);
+
+    const { state, output } = splitReturn(result, operation.name);
+    if (state) Object.assign(accumulators.state, state);
+    if (output) Object.assign(accumulators.output, output);
+
+    if (result?.status === 'error') return { status: 'error', error: result.error };
+    if (result?.status === 'warned') return { status: 'warned', reason: result.reason };
+
+    return { status: 'continue' };
+  } catch (error) {
+    const pending = pendingGate(error, operation.name);
+    if (pending) {
+      Object.assign(accumulators.output, pending.output);
+      return { status: 'warned', reason: pending.reason };
+    }
+
+    console.error(`      ${chalk.red('❌')} Write failed${chalk.dim(`: ${error.message}`)}`);
+    return { status: 'error', error: error.message };
+  }
+}
+
+/**
+ * Create a service runner function
+ *
+ * @param {Object} options - Configuration options
+ * @param {string} options.serviceDir - Absolute path to the service's directory
+ *   (handlers load from its ensure/read/transform/write subdirs). Services pass
+ *   __dirname; context.serviceDir is the fallback for tests/embedding.
+ * @param {Function} options.setup - Optional setup function called before operations
+ *   - Receives: (context) => { skip?, reason?, ...additionalContext }
+ *   - Return { skip: true, reason: 'message' } to skip the service
+ *   - Return additional properties to merge into context (e.g., { api: new API() })
+ * @param {boolean} options.logOperations - Whether to log each operation (default: true)
+ * @param {boolean} options.stopOnError - Whether to stop on first error (default: true)
+ * @returns {Function} - Service runner function
+ */
+function createServiceRunner(options = {}) {
+  const {
+    serviceDir: ownServiceDir = null,
+    setup = null,
+    logOperations = true,
+    stopOnError = true,
+  } = options;
+
+  return async function run(context) {
+    // Run setup if provided
+    let setupResult = {};
+    if (setup) {
+      setupResult = await setup(context);
+
+      if (setupResult?.skip) {
+        console.log(`    ${chalk.dim(`⊘ Skipped (${setupResult.reason || 'setup returned skip'})`)}`);
+        return {
+          status: 'skipped',
+          reason: setupResult.reason,
+          // Machine-readable missing-secret list (cp114) — the run summary
+          // aggregates these into the 🔑 section
+          ...(setupResult.missingEnv ? { missingEnv: setupResult.missingEnv } : {}),
+        };
+      }
+    }
+
+    // Use operations from setup result if provided, otherwise from context
+    const operations = setupResult.operations || context.operations || [];
+
+    // Merge setup result into context
+    const enrichedContext = { ...context, ...setupResult };
+
+    const serviceDir = ownServiceDir || enrichedContext.serviceDir;
+    if (!serviceDir) {
+      throw new Error('serviceDir must be provided via createServiceRunner options or context');
+    }
+
+    // Accumulators: the within-run carry (→ each later operation's
+    // serviceData) vs transient output (→ .omega/runs/{ts}.json). Setup's
+    // serviceData seeds the carry — that's how a service hands its
+    // operations something it resolved once (the Stripe account id).
+    const accumulators = {
+      state: {
+        ...context.serviceData,
+        ...(setupResult.serviceData || {}),
+      },
+      output: {},
+    };
+    let overallStatus = 'success';
+    let firstError = null;
+
+    // What warned/failed, by NAME (#643): the run summary's breakdown reads
+    // these instead of collapsing every operation into "some operations had
+    // issues". `reason` is the operation's own one-liner (never secret
+    // values); null when it gave none, and the summary prints the name alone.
+    const warned = [];
+    const failed = [];
+    const recordWarned = (operation, reason) => warned.push({ operation, reason: reason || null });
+    const recordFailed = (operation, reason) => failed.push({ operation, reason: reason || null });
+
+    // Process operations in order
+    for (const operation of operations) {
+      if (logOperations) {
+        console.log(`    ${chalk.dim('→')} ${operation.name}`);
+      }
+
+      // Handle ensure operations
+      if (operation.ensure) {
+        const result = await runEnsure(serviceDir, operation, enrichedContext, accumulators);
+
+        if (result.status === 'error') {
+          overallStatus = 'error';
+          firstError = firstError || result.error || `${operation.name} failed`;
+          recordFailed(operation.name, result.error);
+          if (stopOnError) break;
+        } else if (result.status === 'warned') {
+          recordWarned(operation.name, result.reason);
+          if (overallStatus !== 'error') overallStatus = 'warned';
+        }
+
+        continue;
+      }
+
+      // Handle read/write operations
+      if (operation.read || operation.write) {
+        let readData = null;
+        const mergedView = { ...accumulators.state, ...accumulators.output };
+
+        // Read phase
+        if (operation.read) {
+          const readResult = await runRead(serviceDir, operation, enrichedContext, mergedView);
+          readData = readResult.data;
+
+          if (readResult.status === 'error') {
+            overallStatus = 'error';
+            firstError = firstError || `${operation.name} read failed`;
+            recordFailed(operation.name, 'read failed');
+            if (stopOnError) break;
+          }
+
+          // A pending gate (#228): carry its marker and move on — there is
+          // nothing to transform or write on top of an operation that never
+          // read
+          if (readResult.status === 'warned') {
+            Object.assign(accumulators.output, readResult.output);
+            recordWarned(operation.name, readResult.reason);
+            if (overallStatus !== 'error') overallStatus = 'warned';
+            continue;
+          }
+
+          // Call onRead hook if provided (e.g., to save read data to disk)
+          if (readData && enrichedContext.onRead) {
+            await enrichedContext.onRead(operation.name, readData);
+          }
+        }
+
+        // Write phase (with optional transform)
+        if (operation.write && readData) {
+          // Transform phase
+          const transformResult = await runTransform(
+            serviceDir, operation, enrichedContext, mergedView, readData,
+          );
+
+          if (transformResult.status === 'error') {
+            overallStatus = 'error';
+            firstError = firstError || `${operation.name} transform failed`;
+            recordFailed(operation.name, 'transform failed');
+            if (stopOnError) break;
+          }
+
+          if (transformResult.status === 'warned') {
+            Object.assign(accumulators.output, transformResult.output);
+            recordWarned(operation.name, transformResult.reason);
+            if (overallStatus !== 'error') overallStatus = 'warned';
+            continue;
+          }
+
+          if (transformResult.status === 'skip') {
+            continue;
+          }
+
+          const writeResult = await runWrite(
+            serviceDir, operation, enrichedContext, accumulators, transformResult.data,
+          );
+
+          if (writeResult.status === 'error') {
+            overallStatus = 'error';
+            firstError = firstError || writeResult.error || `${operation.name} write failed`;
+            recordFailed(operation.name, writeResult.error || 'write failed');
+            if (stopOnError) break;
+          } else if (writeResult.status === 'warned') {
+            recordWarned(operation.name, writeResult.reason);
+            if (overallStatus !== 'error') overallStatus = 'warned';
+          }
+        } else if (operation.write && !operation.read) {
+          // Write-only operation (no read phase)
+          const writeResult = await runWrite(
+            serviceDir, operation, enrichedContext, accumulators, null,
+          );
+
+          if (writeResult.status === 'error') {
+            overallStatus = 'error';
+            firstError = firstError || writeResult.error || `${operation.name} write failed`;
+            recordFailed(operation.name, writeResult.error || 'write failed');
+            if (stopOnError) break;
+          } else if (writeResult.status === 'warned') {
+            recordWarned(operation.name, writeResult.reason);
+            if (overallStatus !== 'error') overallStatus = 'warned';
+          }
+        }
+      }
+    }
+
+    return {
+      status: overallStatus,
+      error: firstError,
+      state: Object.keys(accumulators.state).length > 0 ? accumulators.state : null,
+      output: Object.keys(accumulators.output).length > 0 ? accumulators.output : null,
+      ...(warned.length > 0 ? { warned } : {}),
+      ...(failed.length > 0 ? { failed } : {}),
+    };
+  };
+}
+
+module.exports = { createServiceRunner, getOperationHandler, splitReturn };

package/dist/lib/stale.js

@@ -0,0 +1,24 @@
+/**
+ * Freshness check for derived files — a derived file needs regeneration
+ * when it's missing or older than its source. This is what makes local
+ * file-producing operations idempotent diff-syncs (assets: logo variants
+ * from their SVG sources; certificates: .p12 exports from their .cer):
+ * omega-manager regenerated blindly; the port regenerates only what's
+ * stale, so a converged brand is a zero-work no-op on every run.
+ */
+const { statSync } = require('node:fs');
+const jetpack = require('fs-jetpack');
+
+/**
+ * @param {string} sourcePath - The source file (must exist)
+ * @param {string} derivedPath - The derived file
+ * @returns {boolean} true when the derived file must be (re)generated
+ */
+function isStale(sourcePath, derivedPath) {
+  if (!jetpack.exists(derivedPath)) {
+    return true;
+  }
+  return statSync(derivedPath).mtimeMs < statSync(sourcePath).mtimeMs;
+}
+
+module.exports = { isStale };

package/dist/lib/target-selection.js

@@ -0,0 +1,155 @@
+/**
+ * WHICH targets a brand-root fan-out runs over, in WHICH order, with WHICH
+ * flags — the two pure helpers every fan-out shares.
+ *
+ * They started in commands/deploy.js because deploy was the first fan-out;
+ * `omega update` and the build/clean fan-out (lib/verb-fanout.js) then imported
+ * them from there, which put a lib file under a command. They live HERE, one
+ * home, and deploy.js re-exports them for its own callers.
+ */
+
+// Deploy order — backend's API goes live before the surfaces that call it, and
+// every other fan-out reuses it as the dependency order. A custom target (#603)
+// has no rank, so it lands after every framework one.
+const DEPLOY_ORDER = ['backend', 'web', 'extension', 'desktop', 'mobile'];
+
+// The flag that spells the target picker, on every brand-root verb (#780).
+// ONE name, one constant: commands/test.js reads this very export, so
+// `omega test --target=` and `omega deploy --target=` can never drift.
+const PICKER_FLAG = 'target';
+
+// The pickers `--target=` replaced (#780). Removed, never aliased (no legacy
+// accommodations); `--only` was the collision that forced the rename, since
+// `firebase deploy --only hosting` picks a SERVICE, not a brand target.
+const RETIRED_PICKERS = ['only', 'except'];
+
+// Brand-level flags consumed by the fan-out — everything else forwards to the
+// targets. `_`/`$0` are yargs bookkeeping; continue-on-error is the
+// manage-parity bail switch; --target is the target picker. A caller adds
+// the flags IT consumes (verb-fanout's --dry-run) per call.
+const CONSUMED_KEYS = new Set(['_', '$0', PICKER_FLAG, 'continue-on-error', 'continueOnError']);
+
+/**
+ * Refuse a retired picker (#780), loudly: silently ignoring `--only` would run
+ * the whole brand when a subset was asked for, and aliasing it would keep the
+ * firebase collision alive. A `refusal` error prints its message alone (the
+ * cli-router keeps stacks for bugs), so the one sentence IS the output.
+ *
+ * @param {object} [options] - the parsed CLI options
+ * @throws {Error} when --only or --except was passed
+ */
+function assertPickerFlags(options = {}) {
+  const used = RETIRED_PICKERS.filter((flag) => options[flag] !== undefined);
+  if (used.length === 0) return;
+
+  const error = new Error(`${used.map((flag) => `--${flag}`).join(' and ')} ${used.length > 1 ? 'are' : 'is'} retired: pick targets with --${PICKER_FLAG}=<target|targetDir>[,…] instead (firebase's own --only hosting runs from targets/backend).`);
+  error.refusal = true;
+  throw error;
+}
+
+/**
+ * Refuse a picker token that names nothing (#780). A typo can never quietly
+ * narrow the set: on a publishing verb that would under-deploy, and on any
+ * verb a green exit would stand for work that never ran. The whole run stops,
+ * naming the token and what the brand actually has.
+ *
+ * The MATCHING is the caller's (a fan-out matches key-or-dir, `omega dev`
+ * matches the targets that have a dev leg); the refusal is one implementation.
+ *
+ * @param {string[]} unknown - the tokens that matched nothing
+ * @param {string[]} known - the names a token could have spelled
+ * @throws {Error} when any token matched nothing
+ */
+function assertKnownTargets(unknown, known) {
+  if (unknown.length === 0) return;
+
+  const error = new Error(`Unknown --${PICKER_FLAG} ${unknown.length > 1 ? 'tokens' : 'token'} ${unknown.map((token) => `"${token}"`).join(', ')}: this brand's targets are ${known.join(', ')}. Nothing ran.`);
+  error.refusal = true;
+  throw error;
+}
+
+/**
+ * A comma list of target tokens, trimmed and emptied of blanks.
+ *
+ * @param {string} [value] - the raw flag value
+ * @returns {string[]}
+ */
+function parseTargetTokens(value) {
+  return String(value || '').split(',').map((part) => part.trim()).filter(Boolean);
+}
+
+/**
+ * Does this target answer to this token? A target is named by its KEY ('web')
+ * or by its dir name ('website') — the ONE matcher every brand-root picker
+ * uses, so `--target=` cannot mean one thing on `deploy` and another on `test`.
+ *
+ * @param {{ target: string|null, name: string }} entry - a discovered target
+ * @param {string} token - the picker token
+ * @returns {boolean}
+ */
+function targetMatches(entry, token) {
+  return entry.target === token || entry.name === token;
+}
+
+/**
+ * Pure target selection — which targets run for a given picker, in order.
+ * Picker tokens match a target's key ('web') or its dir name ('website'); no
+ * picker means every target.
+ *
+ * @param {object} input
+ * @param {Array<{ name: string, target: string|null }>} input.targets - the target-mapped target dirs
+ * @param {string} [input.target] - the --target= comma list: the exact set to run
+ * @returns {{ selected: Array }}
+ * @throws {Error} when a token matches no target
+ */
+function selectTargets({ targets, target }) {
+  const tokens = parseTargetTokens(target);
+  assertKnownTargets(
+    tokens.filter((token) => !targets.some((entry) => targetMatches(entry, token))),
+    targets.map((entry) => entry.target || entry.name),
+  );
+
+  const selected = targets
+    .filter((entry) => tokens.length === 0 || tokens.some((token) => targetMatches(entry, token)))
+    .sort((a, b) => {
+      const rank = (entry) => {
+        const index = DEPLOY_ORDER.indexOf(entry.target);
+        return index === -1 ? DEPLOY_ORDER.length : index;
+      };
+      return rank(a) - rank(b);
+    });
+
+  return { selected };
+}
+
+/**
+ * Rebuild forwardable CLI flags from the yargs-parsed options: brand-level
+ * keys are consumed, camelCase twins of kebab-case flags are skipped (yargs
+ * mints both), booleans re-spell as --flag/--no-flag, values as --flag=value.
+ *
+ * @param {object} options - the yargs-parsed options
+ * @param {string[]} [alsoConsumed] - extra keys THIS fan-out consumes (both spellings)
+ * @returns {string[]}
+ */
+function buildForwardedFlags(options, alsoConsumed = []) {
+  const flags = [];
+  const consumed = alsoConsumed.length ? new Set([...CONSUMED_KEYS, ...alsoConsumed]) : CONSUMED_KEYS;
+
+  for (const [key, value] of Object.entries(options)) {
+    if (consumed.has(key)) continue;
+    if (value === undefined || value === null) continue;
+    // Skip yargs' camelCase duplicate when the kebab-case original exists
+    if (/[A-Z]/.test(key) && key.replace(/[A-Z]/g, (c) => `-${c.toLowerCase()}`) in options) continue;
+
+    const values = Array.isArray(value) ? value : [value];
+    for (const entry of values) {
+      if (entry === true) flags.push(`--${key}`);
+      else if (entry === false) flags.push(`--no-${key}`);
+      else flags.push(`--${key}=${entry}`);
+    }
+  }
+
+  return flags;
+}
+
+module.exports = { DEPLOY_ORDER, PICKER_FLAG, CONSUMED_KEYS, assertPickerFlags, assertKnownTargets, selectTargets, buildForwardedFlags, parseTargetTokens, targetMatches };