@starci/hfs 4.11.22 → 4.12.0

package/stack/render.mjs

@@ -11,162 +11,170 @@ import { tool } from './context.mjs';
 import { hasPlaceholderDigest, isImageReference, isReleaseId } from './digest.mjs';
 import { failure, refusal } from './errors.mjs';
 import { configObjects, loadSealed, sha } from './sealed.mjs';
-
 const SOURCE_SHA = /^[0-9a-f]{7,64}$/u;
 const ENV_LINE = /^([A-Z][A-Z0-9_]*)=(.*)$/u;
 const BASE_ENV = ['PATH', 'HOME', 'USERPROFILE', 'SystemRoot', 'TEMP', 'TMP', 'DOCKER_CONFIG'];
 const SECRET_MODE = 0o444;
-
 function checkImages(config, options) {
-  const wanted = Object.keys(config.images);
-  const given = Object.keys(options.images ?? {});
-  const missing = wanted.filter((service) => !given.includes(service));
-  if (missing.length > 0) throw refusal('STACK_IMAGE_MISSING', `no image given for ${missing.join(', ')}`);
-  const unknown = given.filter((service) => !wanted.includes(service));
-  if (unknown.length > 0) throw refusal('STACK_IMAGE_UNKNOWN', `${unknown.join(', ')} is not an image of the deploy block`);
-  for (const service of wanted) {
-    const reference = options.images[service];
-    if (hasPlaceholderDigest(reference)) throw refusal('STACK_PLACEHOLDER_DIGEST', `the image of ${service} carries the all-zero placeholder digest`);
-    if (!isImageReference(reference, options.allowUnpinned === true)) throw refusal('STACK_IMAGE_UNPINNED', `the image of ${service} must be a registry reference pinned by @sha256 digest`);
-  }
+    const wanted = Object.keys(config.images);
+    const images = options.images ?? {};
+    const given = Object.keys(images);
+    const missing = wanted.filter((service) => !given.includes(service));
+    if (missing.length > 0)
+        throw refusal('STACK_IMAGE_MISSING', `no image given for ${missing.join(', ')}`);
+    const unknown = given.filter((service) => !wanted.includes(service));
+    if (unknown.length > 0)
+        throw refusal('STACK_IMAGE_UNKNOWN', `${unknown.join(', ')} is not an image of the deploy block`);
+    for (const service of wanted) {
+        const reference = images[service];
+        if (hasPlaceholderDigest(reference))
+            throw refusal('STACK_PLACEHOLDER_DIGEST', `the image of ${service} carries the all-zero placeholder digest`);
+        if (!isImageReference(reference, options.allowUnpinned === true))
+            throw refusal('STACK_IMAGE_UNPINNED', `the image of ${service} must be a registry reference pinned by @sha256 digest`);
+    }
 }
-
 function checkInputs(config, options) {
-  checkImages(config, options);
-  if (!SOURCE_SHA.test(String(options.sourceSha))) throw refusal('STACK_SOURCE_SHA_INVALID', 'sourceSha must be 7 to 64 lowercase hex characters');
-  if (options.previous !== null && options.previous !== undefined && !isReleaseId(options.previous)) throw refusal('STACK_PREVIOUS_INVALID', 'previous must be 16 lowercase hex characters');
+    checkImages(config, options);
+    if (!SOURCE_SHA.test(String(options.sourceSha)))
+        throw refusal('STACK_SOURCE_SHA_INVALID', 'sourceSha must be 7 to 64 lowercase hex characters');
+    if (options.previous !== null && options.previous !== undefined && !isReleaseId(options.previous))
+        throw refusal('STACK_PREVIOUS_INVALID', 'previous must be 16 lowercase hex characters');
 }
-
 /** Docker reads an absent, empty or 3 version as its current 3.x default; every other version must match exactly. */
 const versionKey = (version) => {
-  const text = version === undefined ? '' : String(version);
-  return text === '' || text === '3' ? null : text;
+    const text = version === undefined ? '' : String(version);
+    return text === '' || text === '3' ? null : text;
 };
-
 function checkComposeVersions(sourceVersion, extraCompose) {
-  for (const file of extraCompose) {
-    const version = readYaml(file, `the extra compose file ${path.basename(file)}`)?.version;
-    if (versionKey(version) !== versionKey(sourceVersion)) {
-      throw refusal('STACK_COMPOSE_VERSION_MISMATCH',
-        `${path.basename(file)} declares compose version ${version ?? '(none)'} but the stack source declares ${sourceVersion ?? '(none)'}; docker stack config refuses files whose versions differ`);
+    for (const file of extraCompose) {
+        const version = readYaml(file, `the extra compose file ${path.basename(file)}`)?.version;
+        if (versionKey(version) !== versionKey(sourceVersion)) {
+            throw refusal('STACK_COMPOSE_VERSION_MISMATCH', `${path.basename(file)} declares compose version ${version ?? '(none)'} but the stack source declares ${sourceVersion ?? '(none)'}; docker stack config refuses files whose versions differ`);
+        }
     }
-  }
 }
-
 /** Compose interpolation treats `$` specially; the override doubles it so a value reaches the service unchanged. */
 const escapeDollar = (value) => value.replaceAll('$', '$$$$');
-
 function envFile(config, rel) {
-  const out = {};
-  for (const line of fs.readFileSync(path.join(config.envDir, rel), 'utf8').split(/\r?\n/u)) {
-    const match = ENV_LINE.exec(line);
-    if (match) out[match[1]] = match[2];
-  }
-  return out;
+    const out = {};
+    for (const line of fs.readFileSync(path.join(config.envDir, rel), 'utf8').split(/\r?\n/u)) {
+        const match = ENV_LINE.exec(line);
+        if (match)
+            out[match[1]] = match[2];
+    }
+    return out;
 }
-
 function plainEnvironment(config, settings, entry) {
-  const out = {};
-  for (const rel of entry.files) Object.assign(out, envFile(config, rel));
-  Object.assign(out, entry.values);
-  for (const [name, setting] of Object.entries(entry.settings)) {
-    const value = settings[setting.key] ?? setting.default;
-    if (value !== null) out[name] = value;
-  }
-  return out;
+    const out = {};
+    for (const rel of entry.files)
+        Object.assign(out, envFile(config, rel));
+    Object.assign(out, entry.values);
+    for (const [name, setting] of Object.entries(entry.settings)) {
+        const value = settings[setting.key] ?? setting.default;
+        if (value !== null)
+            out[name] = value;
+    }
+    return out;
 }
-
 function serviceOverride(config, sealed, images, service) {
-  const grant = config.secrets.grants.find((item) => item.service === service);
-  const environment = plainEnvironment(config, sealed.settings, config.environment[service] ?? { files: [], values: {}, settings: {} });
-  const keys = sealed.grants[service] ?? [];
-  if (grant?.filePointers) for (const key of keys) environment[`${key}_FILE`] = `/run/secrets/${key}`;
-  const out = {};
-  if (images[service] !== undefined) out.image = images[service];
-  if (Object.keys(environment).length > 0) out.environment = Object.fromEntries(Object.entries(environment).map(([name, value]) => [name, escapeDollar(String(value))]));
-  if (keys.length > 0) out.secrets = keys.map((key) => ({ source: key, target: key, mode: SECRET_MODE }));
-  return out;
+    const grant = config.secrets.grants.find((item) => item.service === service);
+    const environment = plainEnvironment(config, sealed.settings, config.environment[service] ?? { files: [], values: {}, settings: {} });
+    const keys = sealed.grants[service] ?? [];
+    if (grant?.filePointers)
+        for (const key of keys)
+            environment[`${key}_FILE`] = `/run/secrets/${key}`;
+    const out = {};
+    const image = images[service];
+    if (image !== undefined)
+        out.image = image;
+    if (Object.keys(environment).length > 0)
+        out.environment = Object.fromEntries(Object.entries(environment).map(([name, value]) => [name, escapeDollar(String(value))]));
+    if (keys.length > 0)
+        out.secrets = keys.map((key) => ({ source: key, target: key, mode: SECRET_MODE }));
+    return out;
 }
-
 function buildOverride(config, sealed, images, version) {
-  const services = new Set([...Object.keys(config.images), ...Object.keys(config.environment), ...Object.keys(sealed.grants)]);
-  return {
-    ...(version === undefined ? {} : { version }),
-    services: Object.fromEntries([...services].sort((a, b) => a.localeCompare(b)).map((service) => [service, serviceOverride(config, sealed, images, service)])),
-    secrets: Object.fromEntries(Object.entries(sealed.secrets).map(([key, entry]) => [key, { external: true, name: entry.runtimeName }])),
-  };
+    const services = new Set([...Object.keys(config.images), ...Object.keys(config.environment), ...Object.keys(sealed.grants)]);
+    return {
+        ...(version === undefined ? {} : { version }),
+        services: Object.fromEntries([...services].sort((a, b) => a.localeCompare(b)).map((service) => [service, serviceOverride(config, sealed, images, service)])),
+        secrets: Object.fromEntries(Object.entries(sealed.secrets).map(([key, entry]) => [key, { external: true, name: entry.runtimeName }])),
+    };
 }
-
 function minimalEnv(ctx, config, configs) {
-  const env = {};
-  for (const name of BASE_ENV) if (ctx.env[name] !== undefined) env[name] = ctx.env[name];
-  for (const name of config.passEnv) env[name] = ctx.env[name] ?? '';
-  for (const object of configs) env[object.env] = object.name;
-  return env;
+    const env = {};
+    for (const name of BASE_ENV)
+        if (ctx.env[name] !== undefined)
+            env[name] = ctx.env[name];
+    for (const name of config.passEnv)
+        env[name] = ctx.env[name] ?? '';
+    for (const object of configs)
+        env[object.env] = object.name;
+    return env;
 }
-
 function dockerRender(ctx, config, overrideFile, options, env) {
-  const files = [config.stackFile, overrideFile, ...(options.extraCompose ?? [])].flatMap((file) => ['-c', file]);
-  const run = tool(ctx, 'docker', ['stack', 'config', ...files], { env });
-  if (run.error) throw failure('STACK_RENDER_FAILED', `cannot run docker (${run.error.message})`);
-  if (run.status !== 0) throw failure('STACK_RENDER_FAILED', run.stderr.trim().split('\n').slice(0, 6).join(' | '));
-  if (hasPlaceholderDigest(run.stdout)) throw refusal('STACK_PLACEHOLDER_DIGEST', 'rendered stack still carries a placeholder digest');
-  // docker stack config has already interpolated every variable, so a dollar left in its output is literal (a source `$`); docker stack
-  // deploy interpolates the written file again, so every dollar is escaped once more to survive that second pass.
-  return escapeDollar(run.stdout);
+    const files = [config.stackFile, overrideFile, ...(options.extraCompose ?? [])].flatMap((file) => ['-c', file]);
+    const run = tool(ctx, 'docker', ['stack', 'config', ...files], { env });
+    if (run.error)
+        throw failure('STACK_RENDER_FAILED', `cannot run docker (${run.error.message})`);
+    if (run.status !== 0)
+        throw failure('STACK_RENDER_FAILED', run.stderr.trim().split('\n').slice(0, 6).join(' | '));
+    if (hasPlaceholderDigest(run.stdout))
+        throw refusal('STACK_PLACEHOLDER_DIGEST', 'rendered stack still carries a placeholder digest');
+    // docker stack config has already interpolated every variable, so a dollar left in its output is literal (a source `$`); docker stack
+    // deploy interpolates the written file again, so every dollar is escaped once more to survive that second pass.
+    return escapeDollar(run.stdout);
 }
-
 function releaseRecord(ctx, config, parts) {
-  const { sealed, configs, options, stackBytes, env } = parts;
-  const passed = Object.fromEntries(config.passEnv.map((name) => [name, env[name]]));
-  const digestInput = { environment: config.environment, settings: Object.entries(sealed.settings).sort(([a], [b]) => a.localeCompare(b)), configs: configs.map((item) => item.name), passed };
-  return {
-    schema: 'starci/stack-release@1',
-    stack: config.stack,
-    releaseDigest: sha(stackBytes),
-    sourceSha: options.sourceSha,
-    images: options.images,
-    configDigest: sha(JSON.stringify(digestInput)),
-    configs: configs.map((item) => ({ logical: item.logical, name: item.name })),
-    secrets: Object.entries(sealed.secrets).map(([key, entry]) => ({ key, runtimeName: entry.runtimeName })).sort((a, b) => a.key.localeCompare(b.key)),
-    healthAssertions: [...config.verify.http, ...config.verify.exec].map((check) => check.name),
-    previousAccepted: options.previous ?? null,
-    renderedAt: new Date(ctx.now()).toISOString(),
-  };
+    const { sealed, configs, options, stackBytes, env } = parts;
+    const passed = Object.fromEntries(config.passEnv.map((name) => [name, env[name]]));
+    const digestInput = { environment: config.environment, settings: Object.entries(sealed.settings).sort(([a], [b]) => a.localeCompare(b)), configs: configs.map((item) => item.name), passed };
+    return {
+        schema: 'starci/stack-release@1',
+        stack: config.stack,
+        releaseDigest: sha(stackBytes),
+        sourceSha: options.sourceSha,
+        images: options.images,
+        configDigest: sha(JSON.stringify(digestInput)),
+        configs: configs.map((item) => ({ logical: item.logical, name: item.name })),
+        secrets: Object.entries(sealed.secrets).map(([key, entry]) => ({ key, runtimeName: entry.runtimeName })).sort((a, b) => a.key.localeCompare(b.key)),
+        healthAssertions: [...config.verify.http, ...config.verify.exec].map((check) => check.name),
+        previousAccepted: options.previous ?? null,
+        renderedAt: new Date(ctx.now()).toISOString(),
+    };
 }
-
 function writeOutput(out, override, stackBytes, release) {
-  fs.mkdirSync(out, { recursive: true });
-  fs.writeFileSync(path.join(out, 'stack.generated.yaml'), `${JSON.stringify(override, null, 2)}\n`);
-  fs.writeFileSync(path.join(out, 'stack.yaml'), stackBytes);
-  fs.writeFileSync(path.join(out, 'release.json'), `${JSON.stringify(release, null, 2)}\n`);
+    fs.mkdirSync(out, { recursive: true });
+    fs.writeFileSync(path.join(out, 'stack.generated.yaml'), `${JSON.stringify(override, null, 2)}\n`);
+    fs.writeFileSync(path.join(out, 'stack.yaml'), stackBytes);
+    fs.writeFileSync(path.join(out, 'release.json'), `${JSON.stringify(release, null, 2)}\n`);
 }
-
 /** Renders a release into `options.out` (a fresh temp directory when null). Effects stay local; nothing leaves the machine. */
 export async function renderRelease(ctx, config, options) {
-  checkInputs(config, options);
-  const sourceVersion = readYaml(config.stackFile, 'the stack source')?.version;
-  checkComposeVersions(sourceVersion, options.extraCompose ?? []);
-  const sealed = loadSealed(ctx, config);
-  const configs = configObjects(config);
-  const override = buildOverride(config, sealed, options.images, sourceVersion);
-  const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'stack-override-'));
-  try {
-    const overrideFile = path.join(scratch, 'stack.generated.yaml');
-    fs.writeFileSync(overrideFile, `${JSON.stringify(override, null, 2)}\n`);
-    const env = minimalEnv(ctx, config, configs);
-    const stackBytes = dockerRender(ctx, config, overrideFile, options, env);
-    const release = releaseRecord(ctx, config, { sealed, configs, options, stackBytes, env });
-    const out = options.out ?? fs.mkdtempSync(path.join(os.tmpdir(), 'stack-render-'));
-    writeOutput(out, override, stackBytes, release);
-    const releaseId = release.releaseDigest.slice(0, 16);
-    const counts = { secrets: release.secrets.length, configs: configs.length };
-    return {
-      ok: true,
-      lines: [`render: release ${releaseId}: ${counts.secrets} secrets, ${counts.configs} configs; images pinned`, `out: ${out}`],
-      data: { releaseDigest: release.releaseDigest, releaseId, out, ...counts },
-    };
-  } finally {
-    fs.rmSync(scratch, { recursive: true, force: true });
-  }
+    checkInputs(config, options);
+    const sourceVersion = readYaml(config.stackFile, 'the stack source')?.version;
+    checkComposeVersions(sourceVersion, options.extraCompose ?? []);
+    const sealed = loadSealed(ctx, config);
+    const configs = configObjects(config);
+    const override = buildOverride(config, sealed, options.images ?? {}, sourceVersion);
+    const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'stack-override-'));
+    try {
+        const overrideFile = path.join(scratch, 'stack.generated.yaml');
+        fs.writeFileSync(overrideFile, `${JSON.stringify(override, null, 2)}\n`);
+        const env = minimalEnv(ctx, config, configs);
+        const stackBytes = dockerRender(ctx, config, overrideFile, options, env);
+        const release = releaseRecord(ctx, config, { sealed, configs, options, stackBytes, env });
+        const out = options.out ?? fs.mkdtempSync(path.join(os.tmpdir(), 'stack-render-'));
+        writeOutput(out, override, stackBytes, release);
+        const releaseId = release.releaseDigest.slice(0, 16);
+        const counts = { secrets: release.secrets.length, configs: configs.length };
+        return {
+            ok: true,
+            lines: [`render: release ${releaseId}: ${counts.secrets} secrets, ${counts.configs} configs; images pinned`, `out: ${out}`],
+            data: { releaseDigest: release.releaseDigest, releaseId, out, ...counts },
+        };
+    }
+    finally {
+        fs.rmSync(scratch, { recursive: true, force: true });
+    }
 }

package/stack/retire.d.mts

@@ -0,0 +1,9 @@
+import type { DeployConfig } from './config.mjs';
+import type { StackContext } from './context.mjs';
+import type { ActionResult, RunnerDeps } from './remote.mjs';
+/** `retire`: dry run unless execute. */
+export declare function retireCompose(ctx: StackContext, config: DeployConfig, { projects, execute, sshCmd }?: {
+    projects?: string[];
+    execute?: boolean;
+    sshCmd?: string | null;
+}, deps?: RunnerDeps): Promise<ActionResult>;

package/stack/retire.mjs

@@ -1,47 +1,44 @@
-// retire.mjs - `starci app stack retire --project <compose project>... [--execute]`: stops the containers of the OLD docker compose projects once the swarm
-// stack has taken over, WITHOUT removing anything. Each container gets `--restart=no` first (a restart policy or a reboot would otherwise start the old
-// model again beside the new one), then `docker stop`; applications first, data stores last (the reverse of the recovery order). Containers, volumes,
-// images and networks stay, so the old model can be started again for a rollback. The legacy edge container is never touched here (it is kept stopped
-// by the takeover for its own retention), and a project that holds it is refused.
 import { refusal } from './errors.mjs';
 import { remoteDocker, withRunner } from './remote.mjs';
 import { snapshotContainers, startOrder } from './live-restore.mjs';
-
 const PROJECT = /^[a-z0-9][a-z0-9_-]*$/u;
 const STOP_GRACE_SECONDS = 45;
-
 function checkProjects(config, projects) {
-  if (projects.length === 0) throw refusal('STACK_RETIRE_NO_PROJECT', 'name the compose projects to retire with --project <name> (repeatable)');
-  for (const project of projects) {
-    if (!PROJECT.test(project)) throw refusal('STACK_RETIRE_PROJECT', `${project} is not a compose project name`);
-    if (project === config.stack) throw refusal('STACK_RETIRE_PROJECT', `${project} is the swarm stack, not an old compose project`);
-  }
+    if (projects.length === 0)
+        throw refusal('STACK_RETIRE_NO_PROJECT', 'name the compose projects to retire with --project <name> (repeatable)');
+    for (const project of projects) {
+        if (!PROJECT.test(project))
+            throw refusal('STACK_RETIRE_PROJECT', `${project} is not a compose project name`);
+        if (project === config.stack)
+            throw refusal('STACK_RETIRE_PROJECT', `${project} is the swarm stack, not an old compose project`);
+    }
 }
-
 /** The running containers of the selected projects, applications first and data stores last. */
 function selected(run, projects) {
-  const all = snapshotContainers(run);
-  const chosen = all.filter((entry) => projects.includes(entry.project));
-  return startOrder(chosen).reverse();
+    const all = snapshotContainers(run);
+    const chosen = all.filter((entry) => projects.includes(entry.project));
+    return startOrder(chosen).reverse();
 }
-
 /** `retire`: dry run unless execute. */
 export async function retireCompose(ctx, config, { projects = [], execute = false, sshCmd = null } = {}, deps = {}) {
-  checkProjects(config, projects);
-  return withRunner(ctx, config, { sshCmd }, deps, (run, notes) => {
-    const containers = selected(run, projects);
-    const edge = config.ingress?.legacy?.container;
-    if (edge && containers.some((entry) => entry.name === edge)) throw refusal('STACK_RETIRE_EDGE', `the project of ${edge} (the legacy edge) is not retired here: the takeover keeps that container stopped for its own retention`);
-    const lines = [...notes, `${containers.length} running container(s) in ${projects.join(', ')}: ${containers.map((entry) => entry.name).join(', ') || 'none'}`];
-    if (containers.length === 0) return { ok: true, lines: [...lines, 'nothing to retire'], data: { stopped: [], failed: [] } };
-    if (!execute) return { ok: true, lines: [...lines, 'dry run: each would get --restart=no and then be stopped (nothing is removed)'], data: { stopped: [], failed: [] } };
-    const stopped = [];
-    const failed = [];
-    for (const entry of containers) {
-      const done = remoteDocker(run, ['update', '--restart=no', entry.name]).status === 0 && remoteDocker(run, ['stop', '-t', String(STOP_GRACE_SECONDS), entry.name]).status === 0;
-      (done ? stopped : failed).push(entry.name);
-    }
-    const outcome = failed.length === 0 ? `retired ${stopped.length} container(s); nothing was removed, start them again with docker start for a rollback` : `FAILED to retire: ${failed.join(', ')}`;
-    return { ok: failed.length === 0, lines: [...lines, outcome], data: { stopped, failed } };
-  });
+    checkProjects(config, projects);
+    return withRunner(ctx, config, { sshCmd }, deps, (run, notes) => {
+        const containers = selected(run, projects);
+        const edge = config.ingress?.legacy?.container;
+        if (edge && containers.some((entry) => entry.name === edge))
+            throw refusal('STACK_RETIRE_EDGE', `the project of ${edge} (the legacy edge) is not retired here: the takeover keeps that container stopped for its own retention`);
+        const lines = [...notes, `${containers.length} running container(s) in ${projects.join(', ')}: ${containers.map((entry) => entry.name).join(', ') || 'none'}`];
+        if (containers.length === 0)
+            return { ok: true, lines: [...lines, 'nothing to retire'], data: { stopped: [], failed: [] } };
+        if (!execute)
+            return { ok: true, lines: [...lines, 'dry run: each would get --restart=no and then be stopped (nothing is removed)'], data: { stopped: [], failed: [] } };
+        const stopped = [];
+        const failed = [];
+        for (const entry of containers) {
+            const done = remoteDocker(run, ['update', '--restart=no', entry.name]).status === 0 && remoteDocker(run, ['stop', '-t', String(STOP_GRACE_SECONDS), entry.name]).status === 0;
+            (done ? stopped : failed).push(entry.name);
+        }
+        const outcome = failed.length === 0 ? `retired ${stopped.length} container(s); nothing was removed, start them again with docker start for a rollback` : `FAILED to retire: ${failed.join(', ')}`;
+        return { ok: failed.length === 0, lines: [...lines, outcome], data: { stopped, failed } };
+    });
 }

package/stack/sealed.d.mts

@@ -0,0 +1,46 @@
+import type { BinaryLike } from 'node:crypto';
+import type { DeployConfig } from './config.mjs';
+import type { StackContext } from './context.mjs';
+/** An opened sealed member: KEY -> value (a value that is not a string is never granted). */
+export type SealedMap = Record<string, unknown>;
+/** One granted secret: its Swarm secret name and its value (in memory only). */
+export interface SealedSecret {
+    runtimeName: string;
+    value: string;
+}
+/** What loadSealed returns: the secrets, the keys each service is granted and the plain settings. */
+export interface LoadedSealed {
+    secrets: Record<string, SealedSecret>;
+    grants: Record<string, string[]>;
+    settings: Record<string, string>;
+}
+/** A non-secret config file mounted into a service, named by the digest of its content. */
+export interface ConfigObject {
+    logical: string;
+    env: string;
+    file: string;
+    name: string;
+}
+/** sha256 of the bytes, as lowercase hex. */
+export declare const sha: (bytes: BinaryLike) => string;
+/** The bytes of a config file as they are hashed and created: LF-normalised text, untouched binary. */
+export declare const configBytes: (file: string) => Buffer;
+/**
+ * True when the sops seam found an age identity (secret-init.mjs decryptionIdentity, the one lookup every decrypt uses). A seam
+ * that reports no `identity` (a spec double) decides for itself.
+ */
+export declare function hasAgeIdentity(ctx: Pick<StackContext, 'sops'>): boolean;
+/** Refuses up front, before any work, when sealed custody must be opened and no age identity is reachable. */
+export declare function requireAgeIdentity(ctx: Pick<StackContext, 'sops'>, _config: DeployConfig, purpose: string): void;
+/**
+ * Opens one sealed member (`<secretsDir>/<member>.enc.yaml`, or a legacy `.enc`) into a { KEY: value } map. A failure is refused
+ * naming the member and the seam's reason (its format, recipients and the identity tried); no value.
+ */
+export declare function openMember(ctx: Pick<StackContext, 'sops'>, config: Pick<DeployConfig, 'secretsDir'>, member: string): SealedMap;
+/**
+ * Opens the sealed members once each and returns what every service is granted:
+ * { secrets: { KEY: { runtimeName, value } }, grants: { service: [KEY...] }, settings: { KEY: value } }. The caller must not log a value.
+ */
+export declare function loadSealed(ctx: StackContext, config: DeployConfig): LoadedSealed;
+/** The config objects: non-secret files mounted into services, named by the digest of their content. */
+export declare const configObjects: (config: Pick<DeployConfig, "configs" | "envDir" | "stack">) => ConfigObject[];