@pipeline-builder/pipeline-manager 3.4.70 → 3.4.72

package/dist/agent/health.js

@@ -0,0 +1,55 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Post-deploy health verification. A CloudFormation CREATE_COMPLETE (or a
+ * finished setup.sh) does NOT mean the app is serving — the ALB targets stay
+ * unhealthy until tasks/pods come up. The real done-signal is the platform's
+ * `/health` + `/ready` endpoints, so the executor polls them with backoff.
+ */
+import https from 'https';
+import axios from 'axios';
+/**
+ * Derive the URL the platform should be reachable at. Local/minikube front the
+ * stack on localhost:8443; EC2/Fargate use the deploy domain. Returns null when
+ * it can't be determined (caller surfaces a "verify manually" note).
+ */
+export function deriveHealthUrl(target, params) {
+    if (target === 'local' || target === 'minikube')
+        return 'https://localhost:8443';
+    const domain = params.domain;
+    return typeof domain === 'string' && domain ? `https://${domain}` : null;
+}
+const agent = new https.Agent({ rejectUnauthorized: false }); // local uses a self-signed cert
+async function probe(url) {
+    try {
+        const res = await axios.get(url, { timeout: 5000, httpsAgent: agent, validateStatus: () => true });
+        return res.status >= 200 && res.status < 300;
+    }
+    catch {
+        return false;
+    }
+}
+const delay = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Poll `<url>/health` then `<url>/ready` until both pass or the timeout elapses.
+ * Non-fatal by design: a timeout returns `healthy: false` with guidance, never throws.
+ */
+export async function waitHealthy(url, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 300_000; // 5 min — services come up async
+    const intervalMs = opts.intervalMs ?? 10_000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        if (await probe(`${url}/health`)) {
+            const ready = await probe(`${url}/ready`);
+            return {
+                url,
+                healthy: true,
+                detail: ready ? 'health + ready OK' : 'health OK (ready not yet — dependencies still warming up)',
+            };
+        }
+        opts.onTick?.(`waiting for ${url}/health …`);
+        await delay(intervalMs);
+    }
+    return { url, healthy: false, detail: `not reachable within ${Math.round(timeoutMs / 1000)}s — check the stack / DNS / health logs` };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVhbHRoLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FnZW50L2hlYWx0aC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwrQ0FBK0M7QUFDL0Msc0NBQXNDO0FBRXRDOzs7OztHQUtHO0FBRUgsT0FBTyxLQUFLLE1BQU0sT0FBTyxDQUFDO0FBQzFCLE9BQU8sS0FBSyxNQUFNLE9BQU8sQ0FBQztBQVMxQjs7OztHQUlHO0FBQ0gsTUFBTSxVQUFVLGVBQWUsQ0FBQyxNQUFnQixFQUFFLE1BQStCO0lBQy9FLElBQUksTUFBTSxLQUFLLE9BQU8sSUFBSSxNQUFNLEtBQUssVUFBVTtRQUFFLE9BQU8sd0JBQXdCLENBQUM7SUFDakYsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUM3QixPQUFPLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsQ0FBQyxDQUFDLFdBQVcsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztBQUMzRSxDQUFDO0FBRUQsTUFBTSxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLGdDQUFnQztBQUU5RixLQUFLLFVBQVUsS0FBSyxDQUFDLEdBQVc7SUFDOUIsSUFBSSxDQUFDO1FBQ0gsTUFBTSxHQUFHLEdBQUcsTUFBTSxLQUFLLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLEtBQUssRUFBRSxjQUFjLEVBQUUsR0FBRyxFQUFFLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNuRyxPQUFPLEdBQUcsQ0FBQyxNQUFNLElBQUksR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLEdBQUcsR0FBRyxDQUFDO0lBQy9DLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDO0FBRUQsTUFBTSxLQUFLLEdBQUcsQ0FBQyxFQUFVLEVBQUUsRUFBRSxDQUFDLElBQUksT0FBTyxDQUFPLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7QUFFMUU7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLEtBQUssVUFBVSxXQUFXLENBQy9CLEdBQVcsRUFDWCxPQUFvRixFQUFFO0lBRXRGLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxTQUFTLElBQUksT0FBTyxDQUFDLENBQUMsaUNBQWlDO0lBQzlFLE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxVQUFVLElBQUksTUFBTSxDQUFDO0lBQzdDLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxTQUFTLENBQUM7SUFFeEMsT0FBTyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsUUFBUSxFQUFFLENBQUM7UUFDN0IsSUFBSSxNQUFNLEtBQUssQ0FBQyxHQUFHLEdBQUcsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxNQUFNLEtBQUssR0FBRyxNQUFNLEtBQUssQ0FBQyxHQUFHLEdBQUcsUUFBUSxDQUFDLENBQUM7WUFDMUMsT0FBTztnQkFDTCxHQUFHO2dCQUNILE9BQU8sRUFBRSxJQUFJO2dCQUNiLE1BQU0sRUFBRSxLQUFLLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixDQUFDLENBQUMsQ0FBQywyREFBMkQ7YUFDbEcsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsZUFBZSxHQUFHLFdBQVcsQ0FBQyxDQUFDO1FBQzdDLE1BQU0sS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzFCLENBQUM7SUFDRCxPQUFPLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLHdCQUF3QixJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMseUNBQXlDLEVBQUUsQ0FBQztBQUN4SSxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQ29weXJpZ2h0IDIwMjYgUGlwZWxpbmUgQnVpbGRlciBDb250cmlidXRvcnNcbi8vIFNQRFgtTGljZW5zZS1JZGVudGlmaWVyOiBBcGFjaGUtMi4wXG5cbi8qKlxuICogUG9zdC1kZXBsb3kgaGVhbHRoIHZlcmlmaWNhdGlvbi4gQSBDbG91ZEZvcm1hdGlvbiBDUkVBVEVfQ09NUExFVEUgKG9yIGFcbiAqIGZpbmlzaGVkIHNldHVwLnNoKSBkb2VzIE5PVCBtZWFuIHRoZSBhcHAgaXMgc2VydmluZyDigJQgdGhlIEFMQiB0YXJnZXRzIHN0YXlcbiAqIHVuaGVhbHRoeSB1bnRpbCB0YXNrcy9wb2RzIGNvbWUgdXAuIFRoZSByZWFsIGRvbmUtc2lnbmFsIGlzIHRoZSBwbGF0Zm9ybSdzXG4gKiBgL2hlYWx0aGAgKyBgL3JlYWR5YCBlbmRwb2ludHMsIHNvIHRoZSBleGVjdXRvciBwb2xscyB0aGVtIHdpdGggYmFja29mZi5cbiAqL1xuXG5pbXBvcnQgaHR0cHMgZnJvbSAnaHR0cHMnO1xuaW1wb3J0IGF4aW9zIGZyb20gJ2F4aW9zJztcbmltcG9ydCB0eXBlIHsgVGFyZ2V0SWQgfSBmcm9tICcuL3RhcmdldHMuanMnO1xuXG5leHBvcnQgaW50ZXJmYWNlIEhlYWx0aFJlc3VsdCB7XG4gIHJlYWRvbmx5IHVybDogc3RyaW5nO1xuICByZWFkb25seSBoZWFsdGh5OiBib29sZWFuO1xuICByZWFkb25seSBkZXRhaWw6IHN0cmluZztcbn1cblxuLyoqXG4gKiBEZXJpdmUgdGhlIFVSTCB0aGUgcGxhdGZvcm0gc2hvdWxkIGJlIHJlYWNoYWJsZSBhdC4gTG9jYWwvbWluaWt1YmUgZnJvbnQgdGhlXG4gKiBzdGFjayBvbiBsb2NhbGhvc3Q6ODQ0MzsgRUMyL0ZhcmdhdGUgdXNlIHRoZSBkZXBsb3kgZG9tYWluLiBSZXR1cm5zIG51bGwgd2hlblxuICogaXQgY2FuJ3QgYmUgZGV0ZXJtaW5lZCAoY2FsbGVyIHN1cmZhY2VzIGEgXCJ2ZXJpZnkgbWFudWFsbHlcIiBub3RlKS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGRlcml2ZUhlYWx0aFVybCh0YXJnZXQ6IFRhcmdldElkLCBwYXJhbXM6IFJlY29yZDxzdHJpbmcsIHVua25vd24+KTogc3RyaW5nIHwgbnVsbCB7XG4gIGlmICh0YXJnZXQgPT09ICdsb2NhbCcgfHwgdGFyZ2V0ID09PSAnbWluaWt1YmUnKSByZXR1cm4gJ2h0dHBzOi8vbG9jYWxob3N0Ojg0NDMnO1xuICBjb25zdCBkb21haW4gPSBwYXJhbXMuZG9tYWluO1xuICByZXR1cm4gdHlwZW9mIGRvbWFpbiA9PT0gJ3N0cmluZycgJiYgZG9tYWluID8gYGh0dHBzOi8vJHtkb21haW59YCA6IG51bGw7XG59XG5cbmNvbnN0IGFnZW50ID0gbmV3IGh0dHBzLkFnZW50KHsgcmVqZWN0VW5hdXRob3JpemVkOiBmYWxzZSB9KTsgLy8gbG9jYWwgdXNlcyBhIHNlbGYtc2lnbmVkIGNlcnRcblxuYXN5bmMgZnVuY3Rpb24gcHJvYmUodXJsOiBzdHJpbmcpOiBQcm9taXNlPGJvb2xlYW4+IHtcbiAgdHJ5IHtcbiAgICBjb25zdCByZXMgPSBhd2FpdCBheGlvcy5nZXQodXJsLCB7IHRpbWVvdXQ6IDUwMDAsIGh0dHBzQWdlbnQ6IGFnZW50LCB2YWxpZGF0ZVN0YXR1czogKCkgPT4gdHJ1ZSB9KTtcbiAgICByZXR1cm4gcmVzLnN0YXR1cyA+PSAyMDAgJiYgcmVzLnN0YXR1cyA8IDMwMDtcbiAgfSBjYXRjaCB7XG4gICAgcmV0dXJuIGZhbHNlO1xuICB9XG59XG5cbmNvbnN0IGRlbGF5ID0gKG1zOiBudW1iZXIpID0+IG5ldyBQcm9taXNlPHZvaWQ+KChyKSA9PiBzZXRUaW1lb3V0KHIsIG1zKSk7XG5cbi8qKlxuICogUG9sbCBgPHVybD4vaGVhbHRoYCB0aGVuIGA8dXJsPi9yZWFkeWAgdW50aWwgYm90aCBwYXNzIG9yIHRoZSB0aW1lb3V0IGVsYXBzZXMuXG4gKiBOb24tZmF0YWwgYnkgZGVzaWduOiBhIHRpbWVvdXQgcmV0dXJucyBgaGVhbHRoeTogZmFsc2VgIHdpdGggZ3VpZGFuY2UsIG5ldmVyIHRocm93cy5cbiAqL1xuZXhwb3J0IGFzeW5jIGZ1bmN0aW9uIHdhaXRIZWFsdGh5KFxuICB1cmw6IHN0cmluZyxcbiAgb3B0czogeyB0aW1lb3V0TXM/OiBudW1iZXI7IGludGVydmFsTXM/OiBudW1iZXI7IG9uVGljaz86IChtc2c6IHN0cmluZykgPT4gdm9pZCB9ID0ge30sXG4pOiBQcm9taXNlPEhlYWx0aFJlc3VsdD4ge1xuICBjb25zdCB0aW1lb3V0TXMgPSBvcHRzLnRpbWVvdXRNcyA/PyAzMDBfMDAwOyAvLyA1IG1pbiDigJQgc2VydmljZXMgY29tZSB1cCBhc3luY1xuICBjb25zdCBpbnRlcnZhbE1zID0gb3B0cy5pbnRlcnZhbE1zID8/IDEwXzAwMDtcbiAgY29uc3QgZGVhZGxpbmUgPSBEYXRlLm5vdygpICsgdGltZW91dE1zO1xuXG4gIHdoaWxlIChEYXRlLm5vdygpIDwgZGVhZGxpbmUpIHtcbiAgICBpZiAoYXdhaXQgcHJvYmUoYCR7dXJsfS9oZWFsdGhgKSkge1xuICAgICAgY29uc3QgcmVhZHkgPSBhd2FpdCBwcm9iZShgJHt1cmx9L3JlYWR5YCk7XG4gICAgICByZXR1cm4ge1xuICAgICAgICB1cmwsXG4gICAgICAgIGhlYWx0aHk6IHRydWUsXG4gICAgICAgIGRldGFpbDogcmVhZHkgPyAnaGVhbHRoICsgcmVhZHkgT0snIDogJ2hlYWx0aCBPSyAocmVhZHkgbm90IHlldCDigJQgZGVwZW5kZW5jaWVzIHN0aWxsIHdhcm1pbmcgdXApJyxcbiAgICAgIH07XG4gICAgfVxuICAgIG9wdHMub25UaWNrPy4oYHdhaXRpbmcgZm9yICR7dXJsfS9oZWFsdGgg4oCmYCk7XG4gICAgYXdhaXQgZGVsYXkoaW50ZXJ2YWxNcyk7XG4gIH1cbiAgcmV0dXJuIHsgdXJsLCBoZWFsdGh5OiBmYWxzZSwgZGV0YWlsOiBgbm90IHJlYWNoYWJsZSB3aXRoaW4gJHtNYXRoLnJvdW5kKHRpbWVvdXRNcyAvIDEwMDApfXMg4oCUIGNoZWNrIHRoZSBzdGFjayAvIEROUyAvIGhlYWx0aCBsb2dzYCB9O1xufVxuIl19

package/dist/agent/post-steps.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Post-install steps.
+ *
+ * After the platform is deployed + health-checked, provision runs an ordered set
+ * of post-install steps: **register** (the admin, via `init-platform.sh`, driven
+ * non-interactively by env — which also performs any opt-in plugin/compliance/
+ * sample loads), then an optional **smoke-test**, **events** (AWS), and any
+ * operator **--post-step** commands. Pure, deterministic assembly here — provision
+ * runs each via the same gated `runScript()` as the deploy.
+ */
+import { type TargetId } from './targets.js';
+export interface PostStep {
+    /** Stable id (`register` / `smoke-test` / `events`) or `custom-N`. */
+    readonly id: string;
+    /** Human label shown in the plan. */
+    readonly label: string;
+    /** The exact command to run. */
+    readonly command: string;
+    /** Non-secret env applied to the child for this step (e.g. LOAD_* for register). */
+    readonly env?: Readonly<Record<string, string>>;
+}
+/** A requested step that doesn't apply to the chosen target. */
+export interface SkippedStep {
+    readonly id: string;
+    readonly reason: string;
+}
+export interface ResolvedPostSteps {
+    readonly steps: PostStep[];
+    readonly skipped: SkippedStep[];
+}
+export interface PostStepOptions {
+    readonly target: TargetId;
+    /** Base URL of the deployed platform (from deriveHealthUrl), or null. */
+    readonly url: string | null;
+    /** AWS region (ec2/fargate), if provided. */
+    readonly region?: string;
+    /** Load-step ids enabled via `--with-*` (drive init-platform's LOAD_* envs + sparse paths). */
+    readonly enabledLoadIds: readonly string[];
+    /** `--build-bootstrap`: build the CodeBuild bootstrap image during register. */
+    readonly buildBootstrap: boolean;
+    /** False when `--no-init` — skips the register step entirely. */
+    readonly init: boolean;
+    readonly smokeTest: boolean;
+    readonly events: boolean;
+    /** Raw operator `--post-step` commands, in order. */
+    readonly steps: readonly string[];
+}
+/**
+ * Resolve the ordered post-install step list: register → smoke-test → events →
+ * custom. `register` carries the load + BUILD_BOOTSTRAP env so init-platform runs
+ * the enabled loads non-interactively. Requested-but-inapplicable steps land in
+ * `skipped` so the caller can warn rather than silently drop them.
+ */
+export declare function resolvePostSteps(opts: PostStepOptions): ResolvedPostSteps;
+//# sourceMappingURL=post-steps.d.ts.map

package/dist/agent/post-steps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"post-steps.d.ts","sourceRoot":"","sources":["../../src/agent/post-steps.ts"],"names":[],"mappings":"AAGA;;;;;;;;;GASG;AAEH,OAAO,EAAc,KAAK,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEzD,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,qCAAqC;IACrC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,gCAAgC;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,oFAAoF;IACpF,QAAQ,CAAC,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACjD;AAED,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,WAAW,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;IAC1B,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C,gFAAgF;IAChF,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,iBAAiB,CA+CzE"}

package/dist/agent/post-steps.js

@@ -0,0 +1,73 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Post-install steps.
+ *
+ * After the platform is deployed + health-checked, provision runs an ordered set
+ * of post-install steps: **register** (the admin, via `init-platform.sh`, driven
+ * non-interactively by env — which also performs any opt-in plugin/compliance/
+ * sample loads), then an optional **smoke-test**, **events** (AWS), and any
+ * operator **--post-step** commands. Pure, deterministic assembly here — provision
+ * runs each via the same gated `runScript()` as the deploy.
+ */
+import { LOAD_STEPS } from './targets.js';
+/** Compute the non-interactive env that drives init-platform's prompts. */
+function registerEnv(enabledLoadIds, buildBootstrap) {
+    const env = { BUILD_BOOTSTRAP: buildBootstrap ? 'y' : 'n' };
+    for (const step of LOAD_STEPS)
+        env[step.env] = enabledLoadIds.includes(step.id) ? 'y' : 'n';
+    return env;
+}
+/**
+ * Resolve the ordered post-install step list: register → smoke-test → events →
+ * custom. `register` carries the load + BUILD_BOOTSTRAP env so init-platform runs
+ * the enabled loads non-interactively. Requested-but-inapplicable steps land in
+ * `skipped` so the caller can warn rather than silently drop them.
+ */
+export function resolvePostSteps(opts) {
+    const steps = [];
+    const skipped = [];
+    if (opts.init) {
+        const enabled = LOAD_STEPS.filter((s) => opts.enabledLoadIds.includes(s.id)).map((s) => s.id);
+        const loads = enabled.length > 0 ? ` (+ ${enabled.join(', ')})` : '';
+        steps.push({
+            id: 'register',
+            label: `Register admin${loads}`,
+            command: `./deploy/bin/init-platform.sh ${opts.target}`,
+            env: registerEnv(opts.enabledLoadIds, opts.buildBootstrap),
+        });
+    }
+    if (opts.smokeTest) {
+        if (opts.url) {
+            // -k: local/minikube front a self-signed cert; harmless against real-cert AWS URLs.
+            steps.push({
+                id: 'smoke-test',
+                label: 'Smoke test — read-only API check',
+                command: `curl -fsSk ${opts.url}/api/version && echo 'smoke-test: API reachable'`,
+            });
+        }
+        else {
+            skipped.push({ id: 'smoke-test', reason: 'no platform URL to probe for this target' });
+        }
+    }
+    if (opts.events) {
+        if (opts.target === 'ec2' || opts.target === 'fargate') {
+            // Requires the pipeline-manager CLI on PATH; reads PLATFORM_BASE_URL /
+            // PLATFORM_SECRET_NAME from the environment (the command validates them).
+            steps.push({
+                id: 'events',
+                label: 'EventBridge ingestion (setup-events)',
+                command: `pipeline-manager setup-events${opts.region ? ` --region ${opts.region}` : ''}`,
+            });
+        }
+        else {
+            skipped.push({ id: 'events', reason: `not applicable to target '${opts.target}' (ec2/fargate only)` });
+        }
+    }
+    opts.steps.forEach((command, i) => {
+        if (command.trim() !== '')
+            steps.push({ id: `custom-${i + 1}`, label: `Custom step ${i + 1}`, command });
+    });
+    return { steps, skipped };
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicG9zdC1zdGVwcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hZ2VudC9wb3N0LXN0ZXBzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7Ozs7OztHQVNHO0FBRUgsT0FBTyxFQUFFLFVBQVUsRUFBaUIsTUFBTSxjQUFjLENBQUM7QUEwQ3pELDJFQUEyRTtBQUMzRSxTQUFTLFdBQVcsQ0FBQyxjQUFpQyxFQUFFLGNBQXVCO0lBQzdFLE1BQU0sR0FBRyxHQUEyQixFQUFFLGVBQWUsRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsR0FBRyxFQUFFLENBQUM7SUFDcEYsS0FBSyxNQUFNLElBQUksSUFBSSxVQUFVO1FBQUUsR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxjQUFjLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUM7SUFDNUYsT0FBTyxHQUFHLENBQUM7QUFDYixDQUFDO0FBRUQ7Ozs7O0dBS0c7QUFDSCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsSUFBcUI7SUFDcEQsTUFBTSxLQUFLLEdBQWUsRUFBRSxDQUFDO0lBQzdCLE1BQU0sT0FBTyxHQUFrQixFQUFFLENBQUM7SUFFbEMsSUFBSSxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDZCxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM5RixNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxPQUFPLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNyRSxLQUFLLENBQUMsSUFBSSxDQUFDO1lBQ1QsRUFBRSxFQUFFLFVBQVU7WUFDZCxLQUFLLEVBQUUsaUJBQWlCLEtBQUssRUFBRTtZQUMvQixPQUFPLEVBQUUsaUNBQWlDLElBQUksQ0FBQyxNQUFNLEVBQUU7WUFDdkQsR0FBRyxFQUFFLFdBQVcsQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLElBQUksQ0FBQyxjQUFjLENBQUM7U0FDM0QsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQUksSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ25CLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ2Isb0ZBQW9GO1lBQ3BGLEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ1QsRUFBRSxFQUFFLFlBQVk7Z0JBQ2hCLEtBQUssRUFBRSxrQ0FBa0M7Z0JBQ3pDLE9BQU8sRUFBRSxjQUFjLElBQUksQ0FBQyxHQUFHLGtEQUFrRDthQUNsRixDQUFDLENBQUM7UUFDTCxDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSwwQ0FBMEMsRUFBRSxDQUFDLENBQUM7UUFDekYsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNoQixJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssS0FBSyxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDdkQsdUVBQXVFO1lBQ3ZFLDBFQUEwRTtZQUMxRSxLQUFLLENBQUMsSUFBSSxDQUFDO2dCQUNULEVBQUUsRUFBRSxRQUFRO2dCQUNaLEtBQUssRUFBRSxzQ0FBc0M7Z0JBQzdDLE9BQU8sRUFBRSxnQ0FBZ0MsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsYUFBYSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRTthQUN6RixDQUFDLENBQUM7UUFDTCxDQUFDO2FBQU0sQ0FBQztZQUNOLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSw2QkFBNkIsSUFBSSxDQUFDLE1BQU0sc0JBQXNCLEVBQUUsQ0FBQyxDQUFDO1FBQ3pHLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxFQUFFLEVBQUU7UUFDaEMsSUFBSSxPQUFPLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRTtZQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsS0FBSyxFQUFFLGVBQWUsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7SUFDM0csQ0FBQyxDQUFDLENBQUM7SUFFSCxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxDQUFDO0FBQzVCLENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBQb3N0LWluc3RhbGwgc3RlcHMuXG4gKlxuICogQWZ0ZXIgdGhlIHBsYXRmb3JtIGlzIGRlcGxveWVkICsgaGVhbHRoLWNoZWNrZWQsIHByb3Zpc2lvbiBydW5zIGFuIG9yZGVyZWQgc2V0XG4gKiBvZiBwb3N0LWluc3RhbGwgc3RlcHM6ICoqcmVnaXN0ZXIqKiAodGhlIGFkbWluLCB2aWEgYGluaXQtcGxhdGZvcm0uc2hgLCBkcml2ZW5cbiAqIG5vbi1pbnRlcmFjdGl2ZWx5IGJ5IGVudiDigJQgd2hpY2ggYWxzbyBwZXJmb3JtcyBhbnkgb3B0LWluIHBsdWdpbi9jb21wbGlhbmNlL1xuICogc2FtcGxlIGxvYWRzKSwgdGhlbiBhbiBvcHRpb25hbCAqKnNtb2tlLXRlc3QqKiwgKipldmVudHMqKiAoQVdTKSwgYW5kIGFueVxuICogb3BlcmF0b3IgKiotLXBvc3Qtc3RlcCoqIGNvbW1hbmRzLiBQdXJlLCBkZXRlcm1pbmlzdGljIGFzc2VtYmx5IGhlcmUg4oCUIHByb3Zpc2lvblxuICogcnVucyBlYWNoIHZpYSB0aGUgc2FtZSBnYXRlZCBgcnVuU2NyaXB0KClgIGFzIHRoZSBkZXBsb3kuXG4gKi9cblxuaW1wb3J0IHsgTE9BRF9TVEVQUywgdHlwZSBUYXJnZXRJZCB9IGZyb20gJy4vdGFyZ2V0cy5qcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUG9zdFN0ZXAge1xuICAvKiogU3RhYmxlIGlkIChgcmVnaXN0ZXJgIC8gYHNtb2tlLXRlc3RgIC8gYGV2ZW50c2ApIG9yIGBjdXN0b20tTmAuICovXG4gIHJlYWRvbmx5IGlkOiBzdHJpbmc7XG4gIC8qKiBIdW1hbiBsYWJlbCBzaG93biBpbiB0aGUgcGxhbi4gKi9cbiAgcmVhZG9ubHkgbGFiZWw6IHN0cmluZztcbiAgLyoqIFRoZSBleGFjdCBjb21tYW5kIHRvIHJ1bi4gKi9cbiAgcmVhZG9ubHkgY29tbWFuZDogc3RyaW5nO1xuICAvKiogTm9uLXNlY3JldCBlbnYgYXBwbGllZCB0byB0aGUgY2hpbGQgZm9yIHRoaXMgc3RlcCAoZS5nLiBMT0FEXyogZm9yIHJlZ2lzdGVyKS4gKi9cbiAgcmVhZG9ubHkgZW52PzogUmVhZG9ubHk8UmVjb3JkPHN0cmluZywgc3RyaW5nPj47XG59XG5cbi8qKiBBIHJlcXVlc3RlZCBzdGVwIHRoYXQgZG9lc24ndCBhcHBseSB0byB0aGUgY2hvc2VuIHRhcmdldC4gKi9cbmV4cG9ydCBpbnRlcmZhY2UgU2tpcHBlZFN0ZXAge1xuICByZWFkb25seSBpZDogc3RyaW5nO1xuICByZWFkb25seSByZWFzb246IHN0cmluZztcbn1cblxuZXhwb3J0IGludGVyZmFjZSBSZXNvbHZlZFBvc3RTdGVwcyB7XG4gIHJlYWRvbmx5IHN0ZXBzOiBQb3N0U3RlcFtdO1xuICByZWFkb25seSBza2lwcGVkOiBTa2lwcGVkU3RlcFtdO1xufVxuXG5leHBvcnQgaW50ZXJmYWNlIFBvc3RTdGVwT3B0aW9ucyB7XG4gIHJlYWRvbmx5IHRhcmdldDogVGFyZ2V0SWQ7XG4gIC8qKiBCYXNlIFVSTCBvZiB0aGUgZGVwbG95ZWQgcGxhdGZvcm0gKGZyb20gZGVyaXZlSGVhbHRoVXJsKSwgb3IgbnVsbC4gKi9cbiAgcmVhZG9ubHkgdXJsOiBzdHJpbmcgfCBudWxsO1xuICAvKiogQVdTIHJlZ2lvbiAoZWMyL2ZhcmdhdGUpLCBpZiBwcm92aWRlZC4gKi9cbiAgcmVhZG9ubHkgcmVnaW9uPzogc3RyaW5nO1xuICAvKiogTG9hZC1zdGVwIGlkcyBlbmFibGVkIHZpYSBgLS13aXRoLSpgIChkcml2ZSBpbml0LXBsYXRmb3JtJ3MgTE9BRF8qIGVudnMgKyBzcGFyc2UgcGF0aHMpLiAqL1xuICByZWFkb25seSBlbmFibGVkTG9hZElkczogcmVhZG9ubHkgc3RyaW5nW107XG4gIC8qKiBgLS1idWlsZC1ib290c3RyYXBgOiBidWlsZCB0aGUgQ29kZUJ1aWxkIGJvb3RzdHJhcCBpbWFnZSBkdXJpbmcgcmVnaXN0ZXIuICovXG4gIHJlYWRvbmx5IGJ1aWxkQm9vdHN0cmFwOiBib29sZWFuO1xuICAvKiogRmFsc2Ugd2hlbiBgLS1uby1pbml0YCDigJQgc2tpcHMgdGhlIHJlZ2lzdGVyIHN0ZXAgZW50aXJlbHkuICovXG4gIHJlYWRvbmx5IGluaXQ6IGJvb2xlYW47XG4gIHJlYWRvbmx5IHNtb2tlVGVzdDogYm9vbGVhbjtcbiAgcmVhZG9ubHkgZXZlbnRzOiBib29sZWFuO1xuICAvKiogUmF3IG9wZXJhdG9yIGAtLXBvc3Qtc3RlcGAgY29tbWFuZHMsIGluIG9yZGVyLiAqL1xuICByZWFkb25seSBzdGVwczogcmVhZG9ubHkgc3RyaW5nW107XG59XG5cbi8qKiBDb21wdXRlIHRoZSBub24taW50ZXJhY3RpdmUgZW52IHRoYXQgZHJpdmVzIGluaXQtcGxhdGZvcm0ncyBwcm9tcHRzLiAqL1xuZnVuY3Rpb24gcmVnaXN0ZXJFbnYoZW5hYmxlZExvYWRJZHM6IHJlYWRvbmx5IHN0cmluZ1tdLCBidWlsZEJvb3RzdHJhcDogYm9vbGVhbik6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4ge1xuICBjb25zdCBlbnY6IFJlY29yZDxzdHJpbmcsIHN0cmluZz4gPSB7IEJVSUxEX0JPT1RTVFJBUDogYnVpbGRCb290c3RyYXAgPyAneScgOiAnbicgfTtcbiAgZm9yIChjb25zdCBzdGVwIG9mIExPQURfU1RFUFMpIGVudltzdGVwLmVudl0gPSBlbmFibGVkTG9hZElkcy5pbmNsdWRlcyhzdGVwLmlkKSA/ICd5JyA6ICduJztcbiAgcmV0dXJuIGVudjtcbn1cblxuLyoqXG4gKiBSZXNvbHZlIHRoZSBvcmRlcmVkIHBvc3QtaW5zdGFsbCBzdGVwIGxpc3Q6IHJlZ2lzdGVyIOKGkiBzbW9rZS10ZXN0IOKGkiBldmVudHMg4oaSXG4gKiBjdXN0b20uIGByZWdpc3RlcmAgY2FycmllcyB0aGUgbG9hZCArIEJVSUxEX0JPT1RTVFJBUCBlbnYgc28gaW5pdC1wbGF0Zm9ybSBydW5zXG4gKiB0aGUgZW5hYmxlZCBsb2FkcyBub24taW50ZXJhY3RpdmVseS4gUmVxdWVzdGVkLWJ1dC1pbmFwcGxpY2FibGUgc3RlcHMgbGFuZCBpblxuICogYHNraXBwZWRgIHNvIHRoZSBjYWxsZXIgY2FuIHdhcm4gcmF0aGVyIHRoYW4gc2lsZW50bHkgZHJvcCB0aGVtLlxuICovXG5leHBvcnQgZnVuY3Rpb24gcmVzb2x2ZVBvc3RTdGVwcyhvcHRzOiBQb3N0U3RlcE9wdGlvbnMpOiBSZXNvbHZlZFBvc3RTdGVwcyB7XG4gIGNvbnN0IHN0ZXBzOiBQb3N0U3RlcFtdID0gW107XG4gIGNvbnN0IHNraXBwZWQ6IFNraXBwZWRTdGVwW10gPSBbXTtcblxuICBpZiAob3B0cy5pbml0KSB7XG4gICAgY29uc3QgZW5hYmxlZCA9IExPQURfU1RFUFMuZmlsdGVyKChzKSA9PiBvcHRzLmVuYWJsZWRMb2FkSWRzLmluY2x1ZGVzKHMuaWQpKS5tYXAoKHMpID0+IHMuaWQpO1xuICAgIGNvbnN0IGxvYWRzID0gZW5hYmxlZC5sZW5ndGggPiAwID8gYCAoKyAke2VuYWJsZWQuam9pbignLCAnKX0pYCA6ICcnO1xuICAgIHN0ZXBzLnB1c2goe1xuICAgICAgaWQ6ICdyZWdpc3RlcicsXG4gICAgICBsYWJlbDogYFJlZ2lzdGVyIGFkbWluJHtsb2Fkc31gLFxuICAgICAgY29tbWFuZDogYC4vZGVwbG95L2Jpbi9pbml0LXBsYXRmb3JtLnNoICR7b3B0cy50YXJnZXR9YCxcbiAgICAgIGVudjogcmVnaXN0ZXJFbnYob3B0cy5lbmFibGVkTG9hZElkcywgb3B0cy5idWlsZEJvb3RzdHJhcCksXG4gICAgfSk7XG4gIH1cblxuICBpZiAob3B0cy5zbW9rZVRlc3QpIHtcbiAgICBpZiAob3B0cy51cmwpIHtcbiAgICAgIC8vIC1rOiBsb2NhbC9taW5pa3ViZSBmcm9udCBhIHNlbGYtc2lnbmVkIGNlcnQ7IGhhcm1sZXNzIGFnYWluc3QgcmVhbC1jZXJ0IEFXUyBVUkxzLlxuICAgICAgc3RlcHMucHVzaCh7XG4gICAgICAgIGlkOiAnc21va2UtdGVzdCcsXG4gICAgICAgIGxhYmVsOiAnU21va2UgdGVzdCDigJQgcmVhZC1vbmx5IEFQSSBjaGVjaycsXG4gICAgICAgIGNvbW1hbmQ6IGBjdXJsIC1mc1NrICR7b3B0cy51cmx9L2FwaS92ZXJzaW9uICYmIGVjaG8gJ3Ntb2tlLXRlc3Q6IEFQSSByZWFjaGFibGUnYCxcbiAgICAgIH0pO1xuICAgIH0gZWxzZSB7XG4gICAgICBza2lwcGVkLnB1c2goeyBpZDogJ3Ntb2tlLXRlc3QnLCByZWFzb246ICdubyBwbGF0Zm9ybSBVUkwgdG8gcHJvYmUgZm9yIHRoaXMgdGFyZ2V0JyB9KTtcbiAgICB9XG4gIH1cblxuICBpZiAob3B0cy5ldmVudHMpIHtcbiAgICBpZiAob3B0cy50YXJnZXQgPT09ICdlYzInIHx8IG9wdHMudGFyZ2V0ID09PSAnZmFyZ2F0ZScpIHtcbiAgICAgIC8vIFJlcXVpcmVzIHRoZSBwaXBlbGluZS1tYW5hZ2VyIENMSSBvbiBQQVRIOyByZWFkcyBQTEFURk9STV9CQVNFX1VSTCAvXG4gICAgICAvLyBQTEFURk9STV9TRUNSRVRfTkFNRSBmcm9tIHRoZSBlbnZpcm9ubWVudCAodGhlIGNvbW1hbmQgdmFsaWRhdGVzIHRoZW0pLlxuICAgICAgc3RlcHMucHVzaCh7XG4gICAgICAgIGlkOiAnZXZlbnRzJyxcbiAgICAgICAgbGFiZWw6ICdFdmVudEJyaWRnZSBpbmdlc3Rpb24gKHNldHVwLWV2ZW50cyknLFxuICAgICAgICBjb21tYW5kOiBgcGlwZWxpbmUtbWFuYWdlciBzZXR1cC1ldmVudHMke29wdHMucmVnaW9uID8gYCAtLXJlZ2lvbiAke29wdHMucmVnaW9ufWAgOiAnJ31gLFxuICAgICAgfSk7XG4gICAgfSBlbHNlIHtcbiAgICAgIHNraXBwZWQucHVzaCh7IGlkOiAnZXZlbnRzJywgcmVhc29uOiBgbm90IGFwcGxpY2FibGUgdG8gdGFyZ2V0ICcke29wdHMudGFyZ2V0fScgKGVjMi9mYXJnYXRlIG9ubHkpYCB9KTtcbiAgICB9XG4gIH1cblxuICBvcHRzLnN0ZXBzLmZvckVhY2goKGNvbW1hbmQsIGkpID0+IHtcbiAgICBpZiAoY29tbWFuZC50cmltKCkgIT09ICcnKSBzdGVwcy5wdXNoKHsgaWQ6IGBjdXN0b20tJHtpICsgMX1gLCBsYWJlbDogYEN1c3RvbSBzdGVwICR7aSArIDF9YCwgY29tbWFuZCB9KTtcbiAgfSk7XG5cbiAgcmV0dXJuIHsgc3RlcHMsIHNraXBwZWQgfTtcbn1cbiJdfQ==

package/dist/agent/prereqs.d.ts

@@ -0,0 +1,25 @@
+import type { TargetId } from './targets.js';
+export interface PrereqCheck {
+    readonly name: string;
+    readonly ok: boolean;
+    readonly detail: string;
+    /** A failing required check blocks deployment; advisory ones are warnings. */
+    readonly required: boolean;
+}
+/** True when git is on PATH (required to bootstrap a clone at all). */
+export declare function gitAvailable(): boolean;
+/**
+ * Cone `sparse-checkout` (+ `--filter=blob:none`) needs git ≥ 2.27. Below that,
+ * the bootstrap falls back to a (correct, just larger) full clone.
+ */
+export declare function gitSupportsSparseCheckout(): boolean;
+/**
+ * Run the read-only prerequisite checks for a target. Pure inspection — safe to
+ * run unconditionally (Phase-1 advisor calls this before assembling the command).
+ */
+export declare function checkPrereqs(target: TargetId, opts?: {
+    bootstrap?: boolean;
+}): PrereqCheck[];
+/** True when every REQUIRED prerequisite passed. */
+export declare function prereqsSatisfied(checks: readonly PrereqCheck[]): boolean;
+//# sourceMappingURL=prereqs.d.ts.map

package/dist/agent/prereqs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prereqs.d.ts","sourceRoot":"","sources":["../../src/agent/prereqs.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAE7C,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAqCD,uEAAuE;AACvE,wBAAgB,YAAY,IAAI,OAAO,CAEtC;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAGnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,WAAW,EAAE,CAwChG;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,GAAG,OAAO,CAExE"}

package/dist/agent/prereqs.js

@@ -0,0 +1,100 @@
+// Copyright 2026 Pipeline Builder Contributors
+// SPDX-License-Identifier: Apache-2.0
+/**
+ * Deterministic, READ-ONLY prerequisite checks per target. No LLM, no mutation —
+ * every command here only inspects (presence checks, `aws sts get-caller-identity`,
+ * `docker info`). This is the kind of thing a script does better than an agent,
+ * so it stays deterministic; the LLM is reserved for NL parsing + diagnosis.
+ */
+import { execSync } from 'child_process';
+/** True if `cmd` is on PATH. */
+function has(cmd) {
+    try {
+        execSync(`command -v ${cmd}`, { stdio: 'ignore', timeout: 5000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** Run a read-only command; return its trimmed stdout or null on failure. */
+function read(cmd) {
+    try {
+        return execSync(cmd, { stdio: ['ignore', 'pipe', 'ignore'], timeout: 15000 }).toString().trim();
+    }
+    catch {
+        return null;
+    }
+}
+function dockerRunning() {
+    return has('docker') && read('docker info --format "{{.ServerVersion}}"') !== null;
+}
+function awsIdentity() {
+    if (!has('aws'))
+        return null;
+    return read('aws sts get-caller-identity --query Account --output text');
+}
+/** Parsed `git --version` as [major, minor], or null if git is absent/unparseable. */
+function gitVersion() {
+    const out = read('git --version');
+    const m = out?.match(/(\d+)\.(\d+)/);
+    return m ? [Number(m[1]), Number(m[2])] : null;
+}
+/** True when git is on PATH (required to bootstrap a clone at all). */
+export function gitAvailable() {
+    return gitVersion() !== null;
+}
+/**
+ * Cone `sparse-checkout` (+ `--filter=blob:none`) needs git ≥ 2.27. Below that,
+ * the bootstrap falls back to a (correct, just larger) full clone.
+ */
+export function gitSupportsSparseCheckout() {
+    const v = gitVersion();
+    return v !== null && (v[0] > 2 || (v[0] === 2 && v[1] >= 27));
+}
+/**
+ * Run the read-only prerequisite checks for a target. Pure inspection — safe to
+ * run unconditionally (Phase-1 advisor calls this before assembling the command).
+ */
+export function checkPrereqs(target, opts = {}) {
+    const checks = [];
+    // `--repo` bootstrap git-clones the platform repo first → git is required. A
+    // git below 2.27 still works (full-clone fallback), so the version is advisory.
+    if (opts.bootstrap) {
+        const v = gitVersion();
+        checks.push({ name: 'git', ok: v !== null, detail: v ? `on PATH (${v[0]}.${v[1]})` : 'install git', required: true });
+        if (v !== null && !gitSupportsSparseCheckout()) {
+            checks.push({ name: 'git ≥ 2.27', ok: false, detail: 'sparse clone needs git ≥ 2.27 — falling back to a full clone', required: false });
+        }
+    }
+    if (target === 'local') {
+        checks.push({
+            name: 'Docker',
+            ok: dockerRunning(),
+            detail: dockerRunning() ? 'daemon reachable' : 'install Docker and start the daemon',
+            required: true,
+        });
+        return checks;
+    }
+    if (target === 'minikube') {
+        checks.push({ name: 'Docker', ok: dockerRunning(), detail: dockerRunning() ? 'daemon reachable' : 'install Docker and start the daemon', required: true });
+        checks.push({ name: 'minikube', ok: has('minikube'), detail: has('minikube') ? 'on PATH' : 'install minikube', required: true });
+        checks.push({ name: 'kubectl', ok: has('kubectl'), detail: has('kubectl') ? 'on PATH' : 'install kubectl', required: true });
+        return checks;
+    }
+    // ec2 + fargate — both need the AWS CLI with working credentials.
+    const account = awsIdentity();
+    checks.push({ name: 'AWS CLI', ok: has('aws'), detail: has('aws') ? 'on PATH' : 'install the AWS CLI v2', required: true });
+    checks.push({
+        name: 'AWS credentials',
+        ok: account !== null,
+        detail: account ? `authenticated (account ${account})` : 'run `aws configure` / set AWS_PROFILE',
+        required: true,
+    });
+    return checks;
+}
+/** True when every REQUIRED prerequisite passed. */
+export function prereqsSatisfied(checks) {
+    return checks.every((c) => c.ok || !c.required);
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJlcmVxcy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3NyYy9hZ2VudC9wcmVyZXFzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLCtDQUErQztBQUMvQyxzQ0FBc0M7QUFFdEM7Ozs7O0dBS0c7QUFFSCxPQUFPLEVBQUUsUUFBUSxFQUFFLE1BQU0sZUFBZSxDQUFDO0FBV3pDLGdDQUFnQztBQUNoQyxTQUFTLEdBQUcsQ0FBQyxHQUFXO0lBQ3RCLElBQUksQ0FBQztRQUNILFFBQVEsQ0FBQyxjQUFjLEdBQUcsRUFBRSxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNsRSxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDO0FBRUQsNkVBQTZFO0FBQzdFLFNBQVMsSUFBSSxDQUFDLEdBQVc7SUFDdkIsSUFBSSxDQUFDO1FBQ0gsT0FBTyxRQUFRLENBQUMsR0FBRyxFQUFFLEVBQUUsS0FBSyxFQUFFLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNsRyxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0FBQ0gsQ0FBQztBQUVELFNBQVMsYUFBYTtJQUNwQixPQUFPLEdBQUcsQ0FBQyxRQUFRLENBQUMsSUFBSSxJQUFJLENBQUMsMkNBQTJDLENBQUMsS0FBSyxJQUFJLENBQUM7QUFDckYsQ0FBQztBQUVELFNBQVMsV0FBVztJQUNsQixJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQzdCLE9BQU8sSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7QUFDM0UsQ0FBQztBQUVELHNGQUFzRjtBQUN0RixTQUFTLFVBQVU7SUFDakIsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ2xDLE1BQU0sQ0FBQyxHQUFHLEdBQUcsRUFBRSxLQUFLLENBQUMsY0FBYyxDQUFDLENBQUM7SUFDckMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7QUFDakQsQ0FBQztBQUVELHVFQUF1RTtBQUN2RSxNQUFNLFVBQVUsWUFBWTtJQUMxQixPQUFPLFVBQVUsRUFBRSxLQUFLLElBQUksQ0FBQztBQUMvQixDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLHlCQUF5QjtJQUN2QyxNQUFNLENBQUMsR0FBRyxVQUFVLEVBQUUsQ0FBQztJQUN2QixPQUFPLENBQUMsS0FBSyxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztBQUNoRSxDQUFDO0FBRUQ7OztHQUdHO0FBQ0gsTUFBTSxVQUFVLFlBQVksQ0FBQyxNQUFnQixFQUFFLE9BQWdDLEVBQUU7SUFDL0UsTUFBTSxNQUFNLEdBQWtCLEVBQUUsQ0FBQztJQUVqQyw2RUFBNkU7SUFDN0UsZ0ZBQWdGO0lBQ2hGLElBQUksSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ25CLE1BQU0sQ0FBQyxHQUFHLFVBQVUsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRSxDQUFDLEtBQUssSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxhQUFhLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDdEgsSUFBSSxDQUFDLEtBQUssSUFBSSxJQUFJLENBQUMseUJBQXlCLEVBQUUsRUFBRSxDQUFDO1lBQy9DLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsWUFBWSxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLDhEQUE4RCxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1FBQzFJLENBQUM7SUFDSCxDQUFDO0lBRUQsSUFBSSxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7UUFDdkIsTUFBTSxDQUFDLElBQUksQ0FBQztZQUNWLElBQUksRUFBRSxRQUFRO1lBQ2QsRUFBRSxFQUFFLGFBQWEsRUFBRTtZQUNuQixNQUFNLEVBQUUsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxxQ0FBcUM7WUFDcEYsUUFBUSxFQUFFLElBQUk7U0FDZixDQUFDLENBQUM7UUFDSCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBSSxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7UUFDMUIsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsRUFBRSxFQUFFLGFBQWEsRUFBRSxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsa0JBQWtCLENBQUMsQ0FBQyxDQUFDLHFDQUFxQyxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzNKLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsVUFBVSxFQUFFLEVBQUUsRUFBRSxHQUFHLENBQUMsVUFBVSxDQUFDLEVBQUUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsRUFBRSxRQUFRLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNqSSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsR0FBRyxDQUFDLFNBQVMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDN0gsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVELGtFQUFrRTtJQUNsRSxNQUFNLE9BQU8sR0FBRyxXQUFXLEVBQUUsQ0FBQztJQUM5QixNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsd0JBQXdCLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDNUgsTUFBTSxDQUFDLElBQUksQ0FBQztRQUNWLElBQUksRUFBRSxpQkFBaUI7UUFDdkIsRUFBRSxFQUFFLE9BQU8sS0FBSyxJQUFJO1FBQ3BCLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLDBCQUEwQixPQUFPLEdBQUcsQ0FBQyxDQUFDLENBQUMsdUNBQXVDO1FBQ2hHLFFBQVEsRUFBRSxJQUFJO0tBQ2YsQ0FBQyxDQUFDO0lBQ0gsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQztBQUVELG9EQUFvRDtBQUNwRCxNQUFNLFVBQVUsZ0JBQWdCLENBQUMsTUFBOEI7SUFDN0QsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xELENBQUMiLCJzb3VyY2VzQ29udGVudCI6WyIvLyBDb3B5cmlnaHQgMjAyNiBQaXBlbGluZSBCdWlsZGVyIENvbnRyaWJ1dG9yc1xuLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEFwYWNoZS0yLjBcblxuLyoqXG4gKiBEZXRlcm1pbmlzdGljLCBSRUFELU9OTFkgcHJlcmVxdWlzaXRlIGNoZWNrcyBwZXIgdGFyZ2V0LiBObyBMTE0sIG5vIG11dGF0aW9uIOKAlFxuICogZXZlcnkgY29tbWFuZCBoZXJlIG9ubHkgaW5zcGVjdHMgKHByZXNlbmNlIGNoZWNrcywgYGF3cyBzdHMgZ2V0LWNhbGxlci1pZGVudGl0eWAsXG4gKiBgZG9ja2VyIGluZm9gKS4gVGhpcyBpcyB0aGUga2luZCBvZiB0aGluZyBhIHNjcmlwdCBkb2VzIGJldHRlciB0aGFuIGFuIGFnZW50LFxuICogc28gaXQgc3RheXMgZGV0ZXJtaW5pc3RpYzsgdGhlIExMTSBpcyByZXNlcnZlZCBmb3IgTkwgcGFyc2luZyArIGRpYWdub3Npcy5cbiAqL1xuXG5pbXBvcnQgeyBleGVjU3luYyB9IGZyb20gJ2NoaWxkX3Byb2Nlc3MnO1xuaW1wb3J0IHR5cGUgeyBUYXJnZXRJZCB9IGZyb20gJy4vdGFyZ2V0cy5qcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgUHJlcmVxQ2hlY2sge1xuICByZWFkb25seSBuYW1lOiBzdHJpbmc7XG4gIHJlYWRvbmx5IG9rOiBib29sZWFuO1xuICByZWFkb25seSBkZXRhaWw6IHN0cmluZztcbiAgLyoqIEEgZmFpbGluZyByZXF1aXJlZCBjaGVjayBibG9ja3MgZGVwbG95bWVudDsgYWR2aXNvcnkgb25lcyBhcmUgd2FybmluZ3MuICovXG4gIHJlYWRvbmx5IHJlcXVpcmVkOiBib29sZWFuO1xufVxuXG4vKiogVHJ1ZSBpZiBgY21kYCBpcyBvbiBQQVRILiAqL1xuZnVuY3Rpb24gaGFzKGNtZDogc3RyaW5nKTogYm9vbGVhbiB7XG4gIHRyeSB7XG4gICAgZXhlY1N5bmMoYGNvbW1hbmQgLXYgJHtjbWR9YCwgeyBzdGRpbzogJ2lnbm9yZScsIHRpbWVvdXQ6IDUwMDAgfSk7XG4gICAgcmV0dXJuIHRydWU7XG4gIH0gY2F0Y2gge1xuICAgIHJldHVybiBmYWxzZTtcbiAgfVxufVxuXG4vKiogUnVuIGEgcmVhZC1vbmx5IGNvbW1hbmQ7IHJldHVybiBpdHMgdHJpbW1lZCBzdGRvdXQgb3IgbnVsbCBvbiBmYWlsdXJlLiAqL1xuZnVuY3Rpb24gcmVhZChjbWQ6IHN0cmluZyk6IHN0cmluZyB8IG51bGwge1xuICB0cnkge1xuICAgIHJldHVybiBleGVjU3luYyhjbWQsIHsgc3RkaW86IFsnaWdub3JlJywgJ3BpcGUnLCAnaWdub3JlJ10sIHRpbWVvdXQ6IDE1MDAwIH0pLnRvU3RyaW5nKCkudHJpbSgpO1xuICB9IGNhdGNoIHtcbiAgICByZXR1cm4gbnVsbDtcbiAgfVxufVxuXG5mdW5jdGlvbiBkb2NrZXJSdW5uaW5nKCk6IGJvb2xlYW4ge1xuICByZXR1cm4gaGFzKCdkb2NrZXInKSAmJiByZWFkKCdkb2NrZXIgaW5mbyAtLWZvcm1hdCBcInt7LlNlcnZlclZlcnNpb259fVwiJykgIT09IG51bGw7XG59XG5cbmZ1bmN0aW9uIGF3c0lkZW50aXR5KCk6IHN0cmluZyB8IG51bGwge1xuICBpZiAoIWhhcygnYXdzJykpIHJldHVybiBudWxsO1xuICByZXR1cm4gcmVhZCgnYXdzIHN0cyBnZXQtY2FsbGVyLWlkZW50aXR5IC0tcXVlcnkgQWNjb3VudCAtLW91dHB1dCB0ZXh0Jyk7XG59XG5cbi8qKiBQYXJzZWQgYGdpdCAtLXZlcnNpb25gIGFzIFttYWpvciwgbWlub3JdLCBvciBudWxsIGlmIGdpdCBpcyBhYnNlbnQvdW5wYXJzZWFibGUuICovXG5mdW5jdGlvbiBnaXRWZXJzaW9uKCk6IFtudW1iZXIsIG51bWJlcl0gfCBudWxsIHtcbiAgY29uc3Qgb3V0ID0gcmVhZCgnZ2l0IC0tdmVyc2lvbicpO1xuICBjb25zdCBtID0gb3V0Py5tYXRjaCgvKFxcZCspXFwuKFxcZCspLyk7XG4gIHJldHVybiBtID8gW051bWJlcihtWzFdKSwgTnVtYmVyKG1bMl0pXSA6IG51bGw7XG59XG5cbi8qKiBUcnVlIHdoZW4gZ2l0IGlzIG9uIFBBVEggKHJlcXVpcmVkIHRvIGJvb3RzdHJhcCBhIGNsb25lIGF0IGFsbCkuICovXG5leHBvcnQgZnVuY3Rpb24gZ2l0QXZhaWxhYmxlKCk6IGJvb2xlYW4ge1xuICByZXR1cm4gZ2l0VmVyc2lvbigpICE9PSBudWxsO1xufVxuXG4vKipcbiAqIENvbmUgYHNwYXJzZS1jaGVja291dGAgKCsgYC0tZmlsdGVyPWJsb2I6bm9uZWApIG5lZWRzIGdpdCDiiaUgMi4yNy4gQmVsb3cgdGhhdCxcbiAqIHRoZSBib290c3RyYXAgZmFsbHMgYmFjayB0byBhIChjb3JyZWN0LCBqdXN0IGxhcmdlcikgZnVsbCBjbG9uZS5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdpdFN1cHBvcnRzU3BhcnNlQ2hlY2tvdXQoKTogYm9vbGVhbiB7XG4gIGNvbnN0IHYgPSBnaXRWZXJzaW9uKCk7XG4gIHJldHVybiB2ICE9PSBudWxsICYmICh2WzBdID4gMiB8fCAodlswXSA9PT0gMiAmJiB2WzFdID49IDI3KSk7XG59XG5cbi8qKlxuICogUnVuIHRoZSByZWFkLW9ubHkgcHJlcmVxdWlzaXRlIGNoZWNrcyBmb3IgYSB0YXJnZXQuIFB1cmUgaW5zcGVjdGlvbiDigJQgc2FmZSB0b1xuICogcnVuIHVuY29uZGl0aW9uYWxseSAoUGhhc2UtMSBhZHZpc29yIGNhbGxzIHRoaXMgYmVmb3JlIGFzc2VtYmxpbmcgdGhlIGNvbW1hbmQpLlxuICovXG5leHBvcnQgZnVuY3Rpb24gY2hlY2tQcmVyZXFzKHRhcmdldDogVGFyZ2V0SWQsIG9wdHM6IHsgYm9vdHN0cmFwPzogYm9vbGVhbiB9ID0ge30pOiBQcmVyZXFDaGVja1tdIHtcbiAgY29uc3QgY2hlY2tzOiBQcmVyZXFDaGVja1tdID0gW107XG5cbiAgLy8gYC0tcmVwb2AgYm9vdHN0cmFwIGdpdC1jbG9uZXMgdGhlIHBsYXRmb3JtIHJlcG8gZmlyc3Qg4oaSIGdpdCBpcyByZXF1aXJlZC4gQVxuICAvLyBnaXQgYmVsb3cgMi4yNyBzdGlsbCB3b3JrcyAoZnVsbC1jbG9uZSBmYWxsYmFjayksIHNvIHRoZSB2ZXJzaW9uIGlzIGFkdmlzb3J5LlxuICBpZiAob3B0cy5ib290c3RyYXApIHtcbiAgICBjb25zdCB2ID0gZ2l0VmVyc2lvbigpO1xuICAgIGNoZWNrcy5wdXNoKHsgbmFtZTogJ2dpdCcsIG9rOiB2ICE9PSBudWxsLCBkZXRhaWw6IHYgPyBgb24gUEFUSCAoJHt2WzBdfS4ke3ZbMV19KWAgOiAnaW5zdGFsbCBnaXQnLCByZXF1aXJlZDogdHJ1ZSB9KTtcbiAgICBpZiAodiAhPT0gbnVsbCAmJiAhZ2l0U3VwcG9ydHNTcGFyc2VDaGVja291dCgpKSB7XG4gICAgICBjaGVja3MucHVzaCh7IG5hbWU6ICdnaXQg4omlIDIuMjcnLCBvazogZmFsc2UsIGRldGFpbDogJ3NwYXJzZSBjbG9uZSBuZWVkcyBnaXQg4omlIDIuMjcg4oCUIGZhbGxpbmcgYmFjayB0byBhIGZ1bGwgY2xvbmUnLCByZXF1aXJlZDogZmFsc2UgfSk7XG4gICAgfVxuICB9XG5cbiAgaWYgKHRhcmdldCA9PT0gJ2xvY2FsJykge1xuICAgIGNoZWNrcy5wdXNoKHtcbiAgICAgIG5hbWU6ICdEb2NrZXInLFxuICAgICAgb2s6IGRvY2tlclJ1bm5pbmcoKSxcbiAgICAgIGRldGFpbDogZG9ja2VyUnVubmluZygpID8gJ2RhZW1vbiByZWFjaGFibGUnIDogJ2luc3RhbGwgRG9ja2VyIGFuZCBzdGFydCB0aGUgZGFlbW9uJyxcbiAgICAgIHJlcXVpcmVkOiB0cnVlLFxuICAgIH0pO1xuICAgIHJldHVybiBjaGVja3M7XG4gIH1cblxuICBpZiAodGFyZ2V0ID09PSAnbWluaWt1YmUnKSB7XG4gICAgY2hlY2tzLnB1c2goeyBuYW1lOiAnRG9ja2VyJywgb2s6IGRvY2tlclJ1bm5pbmcoKSwgZGV0YWlsOiBkb2NrZXJSdW5uaW5nKCkgPyAnZGFlbW9uIHJlYWNoYWJsZScgOiAnaW5zdGFsbCBEb2NrZXIgYW5kIHN0YXJ0IHRoZSBkYWVtb24nLCByZXF1aXJlZDogdHJ1ZSB9KTtcbiAgICBjaGVja3MucHVzaCh7IG5hbWU6ICdtaW5pa3ViZScsIG9rOiBoYXMoJ21pbmlrdWJlJyksIGRldGFpbDogaGFzKCdtaW5pa3ViZScpID8gJ29uIFBBVEgnIDogJ2luc3RhbGwgbWluaWt1YmUnLCByZXF1aXJlZDogdHJ1ZSB9KTtcbiAgICBjaGVja3MucHVzaCh7IG5hbWU6ICdrdWJlY3RsJywgb2s6IGhhcygna3ViZWN0bCcpLCBkZXRhaWw6IGhhcygna3ViZWN0bCcpID8gJ29uIFBBVEgnIDogJ2luc3RhbGwga3ViZWN0bCcsIHJlcXVpcmVkOiB0cnVlIH0pO1xuICAgIHJldHVybiBjaGVja3M7XG4gIH1cblxuICAvLyBlYzIgKyBmYXJnYXRlIOKAlCBib3RoIG5lZWQgdGhlIEFXUyBDTEkgd2l0aCB3b3JraW5nIGNyZWRlbnRpYWxzLlxuICBjb25zdCBhY2NvdW50ID0gYXdzSWRlbnRpdHkoKTtcbiAgY2hlY2tzLnB1c2goeyBuYW1lOiAnQVdTIENMSScsIG9rOiBoYXMoJ2F3cycpLCBkZXRhaWw6IGhhcygnYXdzJykgPyAnb24gUEFUSCcgOiAnaW5zdGFsbCB0aGUgQVdTIENMSSB2MicsIHJlcXVpcmVkOiB0cnVlIH0pO1xuICBjaGVja3MucHVzaCh7XG4gICAgbmFtZTogJ0FXUyBjcmVkZW50aWFscycsXG4gICAgb2s6IGFjY291bnQgIT09IG51bGwsXG4gICAgZGV0YWlsOiBhY2NvdW50ID8gYGF1dGhlbnRpY2F0ZWQgKGFjY291bnQgJHthY2NvdW50fSlgIDogJ3J1biBgYXdzIGNvbmZpZ3VyZWAgLyBzZXQgQVdTX1BST0ZJTEUnLFxuICAgIHJlcXVpcmVkOiB0cnVlLFxuICB9KTtcbiAgcmV0dXJuIGNoZWNrcztcbn1cblxuLyoqIFRydWUgd2hlbiBldmVyeSBSRVFVSVJFRCBwcmVyZXF1aXNpdGUgcGFzc2VkLiAqL1xuZXhwb3J0IGZ1bmN0aW9uIHByZXJlcXNTYXRpc2ZpZWQoY2hlY2tzOiByZWFkb25seSBQcmVyZXFDaGVja1tdKTogYm9vbGVhbiB7XG4gIHJldHVybiBjaGVja3MuZXZlcnkoKGMpID0+IGMub2sgfHwgIWMucmVxdWlyZWQpO1xufVxuIl19

package/dist/agent/targets.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Deterministic registry of platform deploy targets — the source of truth the
+ * `provision` advisor uses to assemble the EXACT deploy command. The agent is a
+ * thin wrapper over the existing deploy scripts; it never reimplements
+ * deployment, only validates inputs and assembles the command to run.
+ *
+ * Keep this in lock-step with the flags the scripts accept — every target's
+ * operator entrypoint is `bin/setup.sh` (deploy/<target>/bin/setup.sh).
+ */
+export type TargetId = 'local' | 'minikube' | 'ec2' | 'fargate';
+/** A single input the underlying deploy script accepts. */
+export interface InputSpec {
+    /** Flag name passed to the script (without the leading `--`). */
+    readonly flag: string;
+    /** Key on the provision params object. */
+    readonly key: string;
+    /** Human description — shown when a required input is missing. */
+    readonly description: string;
+    /** Secret — never printed in the assembled command (masked as `***`). */
+    readonly secret?: boolean;
+    /** Boolean flag with no value (e.g. `--email`). */
+    readonly boolean?: boolean;
+}
+export interface TargetSpec {
+    readonly id: TargetId;
+    readonly label: string;
+    /** Directory the entrypoint runs from (relative to repo root). */
+    readonly dir: string;
+    /** Entrypoint script (relative to `dir`). */
+    readonly entrypoint: string;
+    /** Inputs the script REQUIRES — the advisor reports any that are missing. */
+    readonly required: readonly InputSpec[];
+    /** Optional inputs, passed through only when provided. */
+    readonly optional: readonly InputSpec[];
+    /**
+     * Repo folder(s) this target's deploy needs, for a sparse `--repo` bootstrap.
+     * Combined with COMMON_SPARSE_PATHS and any selected load steps' paths.
+     */
+    readonly sparsePaths: readonly string[];
+    /** Post-deploy step to surface (registers admin + loads plugins). */
+    readonly postDeploy?: string;
+    /** Rough monthly cost (from docs). */
+    readonly cost: string;
+    /** One-line "best for". */
+    readonly bestFor: string;
+    /** What a teardown of this target destroys — shown before a (gated) teardown. */
+    readonly destroys: string;
+}
+export declare const TARGETS: Readonly<Record<TargetId, TargetSpec>>;
+export declare const TARGET_IDS: readonly TargetId[];
+export declare function isTargetId(value: unknown): value is TargetId;
+/**
+ * Folders every `--repo` bootstrap needs regardless of target: the orchestration
+ * scripts. Each target's setup.sh + init-platform.sh live in / drive these.
+ * Deliberately minimal — heavier folders (plugins/compliance/samples) are pulled
+ * in only when their post-install option is selected (see LOAD_STEPS).
+ */
+export declare const COMMON_SPARSE_PATHS: readonly string[];
+/**
+ * Opt-in post-install load steps. Each maps a provision `--with-*` flag to the
+ * init-platform env var that enables it AND the repo folder(s) it reads — so the
+ * sparse checkout grows exactly with the selected options.
+ */
+export declare const LOAD_STEPS: readonly [{
+    readonly id: "plugins";
+    readonly flag: "withPlugins";
+    readonly env: "LOAD_PLUGINS";
+    readonly paths: readonly ["deploy/plugins", "deploy/codebuild"];
+}, {
+    readonly id: "compliance";
+    readonly flag: "withCompliance";
+    readonly env: "LOAD_COMPLIANCE";
+    readonly paths: readonly ["deploy/compliance"];
+}, {
+    readonly id: "samples";
+    readonly flag: "withSamples";
+    readonly env: "LOAD_PIPELINES";
+    readonly paths: readonly ["deploy/samples"];
+}];
+export type LoadStepId = (typeof LOAD_STEPS)[number]['id'];
+/**
+ * The de-duplicated set of sparse paths for a target plus the enabled load
+ * steps: common base ∪ target folder(s) ∪ each enabled step's folder(s).
+ */
+export declare function sparsePathsFor(target: TargetId, enabledLoadIds: readonly string[]): string[];
+export interface AssembleResult {
+    /** The exact command to run — secrets masked as `***`. */
+    readonly command: string;
+    /** Required inputs that were not supplied. */
+    readonly missing: readonly InputSpec[];
+}
+/**
+ * Assemble the deploy command for a target from the provided params. Pure and
+ * deterministic — no shell, no LLM. Missing required inputs are reported (never
+ * guessed). By default secrets are masked (`***`) for DISPLAY; pass `mask: false`
+ * to build the real command for EXECUTION — that string must never be logged or
+ * shown to the model.
+ */
+export declare function assembleCommand(target: TargetSpec, params: Record<string, unknown>, opts?: {
+    mask?: boolean;
+}): AssembleResult;
+export interface TeardownResult {
+    /** The exact teardown command to run. */
+    readonly command: string;
+    /** Whether this teardown irreversibly destroys data (AWS targets). */
+    readonly destructive: boolean;
+}
+/**
+ * Assemble the teardown command for a target. Pure and deterministic — mirrors
+ * `assembleCommand` for the destroy path. local/minikube STOP the stack
+ * (non-destructive — on-disk / PVC data survives); ec2/fargate DELETE their
+ * CloudFormation stacks and are irreversible. For Fargate, `assumeYes` forwards
+ * the native script's own `--yes` (the agent runs its own typed confirmation
+ * first, so the script must not also block on stdin); EC2 `delete-stack` has no
+ * native prompt, which is exactly why the agent gate is mandatory there.
+ */
+export declare function teardownCommand(target: TargetId, opts?: {
+    stackName?: string;
+    region?: string;
+    assumeYes?: boolean;
+}): TeardownResult;
+//# sourceMappingURL=targets.d.ts.map

package/dist/agent/targets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../../src/agent/targets.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,KAAK,GAAG,SAAS,CAAC;AAEhE,2DAA2D;AAC3D,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0CAA0C;IAC1C,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,kEAAkE;IAClE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,mDAAmD;IACnD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,6CAA6C;IAC7C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IACxC,0DAA0D;IAC1D,QAAQ,CAAC,QAAQ,EAAE,SAAS,SAAS,EAAE,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,qEAAqE;IACrE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2BAA2B;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,iFAAiF;IACjF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AA0BD,eAAO,MAAM,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAqD1D,CAAC;AAEF,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAA4C,CAAC;AAEvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,QAAQ,CAE5D;AAID;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,SAAS,MAAM,EAAmB,CAAC;AAErE;;;;GAIG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;EAKb,CAAC;AAEX,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC;AAE3D;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAO5F;AAED,MAAM,WAAW,cAAc;IAC7B,0DAA0D;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,SAAS,EAAE,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAC5B,cAAc,CAqBhB;AAED,MAAM,WAAW,cAAc;IAC7B,yCAAyC;IACzC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;CAC/B;AAOD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,QAAQ,EAChB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GACtE,cAAc,CA0BhB"}