@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/readiness/infra-deploy.readiness.cli-command.impl.js

@@ -0,0 +1,678 @@
+import { infraDeployLogger } from "../../logger.js";
+import { realpathChecked } from '@vibesdotdev/filesystem';
+import { GIT_CHILD_ENV } from '@vibesdotdev/git-operations/core';
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { CapabilityError, composeChildEnv, isCapabilityError, requireRuntimeCwd, settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { z } from 'zod/v4';
+import { repositoryGroupRoot } from '@vibesdotdev/config/repository-collection';
+import { loadDeploymentConfig, NonDeployableDeploymentConfigError, resolveAppDir, resolveConfigLoadHost } from "../../config-loader.js";
+import { declaresDeployment, findConfigFile, locateDeploymentSource } from "../../deployment-settings.js";
+import { readString } from "../shared/option-strings.js";
+import { resolveRuntimeExecution } from "../shared/runtime-execution.js";
+import { readRepositoryCollection, registeredAppCheckouts } from "../shared/repository-collection.js";
+import { formatDeploymentEnvironmentResolution, resolveDeploymentEnvironment } from "../../deployment-environment.js";
+import { DeploymentEnvironmentFactsSchema, DeploymentProviderDescriptorSchema, DeploymentReadinessCheckSchema } from '@vibesdotdev/infra-core/kinds';
+import { projectWebApp } from '@vibesdotdev/infra-core';
+import { normalizeDeploymentEnvironment } from '@vibesdotdev/infra-core/deployment-environment';
+import { deploymentModuleEvaluation, resolveDeploymentProvider } from "../run/deployment-provider.js";
+import { inspectRegistryStandaloneSelectors } from '@vibesdotdev/registry/standalone-install';
+import { resolveGitRepositoryRoot } from "../run/git-source-identity.js";
+function failureMessage(failure) {
+    return failure instanceof Error ? failure.message : failure.description;
+}
+function runtimeEnvironmentDescriptors(runtime) {
+    return runtime.query('config/environment').descriptors();
+}
+export function checkDeploymentEnvironment(resolution) {
+    const violations = resolution.violations;
+    return {
+        id: 'deployment-environment',
+        label: 'Selected deployment environment',
+        status: violations.length > 0 ? 'fail' : 'pass',
+        summary: violations.length > 0
+            ? `Environment ${resolution.environment} is unsafe for ${resolution.mutationSurface}.`
+            : `Environment ${resolution.environment} resolves an explicit ${resolution.mutationSurface} descriptor.`,
+        evidence: [
+            formatDeploymentEnvironmentResolution(resolution),
+            `required secret names: ${resolution.requiredSecrets.join(', ') || 'none'}`,
+            `optional secret names: ${resolution.optionalSecrets.join(', ') || 'none'}`,
+            ...violations
+        ],
+        action: violations.length > 0
+            ? 'Fix the unit deployment declaration (vibes.config.ts or its deployment module) or its provider projection; do not bypass the selected-environment gate.'
+            : null
+    };
+}
+const FiniteNumberSchema = z.number().finite();
+const NumericTextSchema = z.string().min(1);
+function readNumber(value) {
+    const direct = FiniteNumberSchema.safeParse(value);
+    if (direct.success)
+        return direct.data;
+    const text = NumericTextSchema.safeParse(value);
+    if (!text.success)
+        return undefined;
+    const parsed = FiniteNumberSchema.safeParse(Number(text.data));
+    return parsed.success ? parsed.data : undefined;
+}
+async function runReadOnlyCommand(runtime, execution, cwd, command) {
+    const [program, ...args] = command;
+    if (!program)
+        throw new Error('A command program is required.');
+    const outcome = await settle(async () => {
+        const env = composeChildEnv(runtime, { env: {}, inheritEnv: GIT_CHILD_ENV });
+        return execution.execute({ command: program, args, cwd, timeout: 10_000, env, envMode: 'replace' });
+    });
+    if (outcome.ok) {
+        return {
+            exitCode: outcome.value.exitCode ?? 1,
+            stdout: outcome.value.stdout,
+            stderr: outcome.value.stderr
+        };
+    }
+    return {
+        exitCode: 127,
+        stdout: '',
+        stderr: '',
+        error: failureMessage(outcome.cause)
+    };
+}
+/**
+ * The repository collection the bound workspace declares, or null for an
+ * ordinary workspace (an end-user project). Only a missing manifest means
+ * "no collection"; an unreadable or invalid one fails.
+ */
+async function boundCollection(configHost, workspaceRoot) {
+    const outcome = await settle(() => readRepositoryCollection(configHost, workspaceRoot));
+    if (outcome.ok)
+        return outcome.value;
+    // Only a missing manifest means "no collection"; an unreadable or invalid
+    // one fails.
+    if (outcome.cause instanceof CapabilityError &&
+        outcome.cause.reason === 'repository-collection-missing') {
+        return null;
+    }
+    throw outcome.cause;
+}
+function parsePorcelain(output) {
+    return output
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => line.slice(3).trim())
+        .filter(Boolean);
+}
+const PackageExportEntrySchema = z.record(z.string(), z.string());
+const PackageExportsSchema = z.record(z.string(), PackageExportEntrySchema);
+function packageExportHasConditions(exportsField, subpath, conditions) {
+    const parsed = PackageExportsSchema.safeParse(exportsField);
+    if (!parsed.success)
+        return false;
+    const entry = parsed.data[subpath];
+    if (!entry)
+        return false;
+    return conditions.every((condition) => Boolean(entry[condition]));
+}
+function summarize(checks) {
+    const passing = checks.filter((check) => check.status === 'pass').length;
+    const warnings = checks.filter((check) => check.status === 'warn').length;
+    const failures = checks.filter((check) => check.status === 'fail').length;
+    const unknown = checks.filter((check) => check.status === 'unknown').length;
+    const status = failures > 0 ? 'fail' : warnings > 0 ? 'warn' : unknown > 0 ? 'unknown' : 'pass';
+    return { status, passing, warnings, failures, unknown };
+}
+function firstLine(value) {
+    return (value
+        .split('\n')
+        .map((line) => line.trim())
+        .find(Boolean) ?? '');
+}
+function isPathWithin(paths, root, candidate) {
+    const path = paths.relative(root, candidate);
+    return (path === '' ||
+        (!paths.isAbsolute(path) && path !== '..' && !path.startsWith('../') && !path.startsWith('..\\')));
+}
+async function readHostText(host, path) {
+    return z.string().parse(await host.files.readFile(path, 'utf8'));
+}
+export async function checkWorktree(input) {
+    const repository = await runReadOnlyCommand(input.runtime, input.execution, input.appDir, [
+        'git',
+        'rev-parse',
+        '--show-toplevel'
+    ]);
+    if (repository.exitCode !== 0) {
+        return {
+            id: 'clean-worktree',
+            label: 'Clean deploy-sensitive worktree',
+            status: 'unknown',
+            summary: repository.error ??
+                (firstLine(repository.stderr) || 'The app Git repository could not be resolved.'),
+            evidence: [`git rev-parse --show-toplevel exited ${repository.exitCode}`],
+            action: 'Run the readiness check from an app owned by a Git worktree before treating this candidate as deployable.'
+        };
+    }
+    const host = await resolveConfigLoadHost(input.runtime);
+    const repositoryRoot = await realpathChecked(host.files, host.paths.resolve(firstLine(repository.stdout)));
+    const appDir = await realpathChecked(host.files, input.appDir);
+    const workspaceRoot = await realpathChecked(host.files, input.workspaceRoot);
+    if (!isPathWithin(host.paths, repositoryRoot, appDir)) {
+        return {
+            id: 'clean-worktree',
+            label: 'Clean deploy-sensitive worktree',
+            status: 'unknown',
+            summary: 'The resolved app path is outside its reported Git repository.',
+            evidence: [repositoryRoot, appDir],
+            action: 'Resolve the app checkout before treating this candidate as deployable.'
+        };
+    }
+    const candidatePaths = [
+        appDir,
+        host.paths.join(repositoryRoot, 'bun.lock'),
+        host.paths.join(repositoryRoot, 'package.json'),
+        host.paths.join(workspaceRoot, 'bun.lock'),
+        host.paths.join(workspaceRoot, 'package.json'),
+        host.paths.join(workspaceRoot, 'infra-deploy'),
+        host.paths.join(workspaceRoot, 'infra-core'),
+        host.paths.join(workspaceRoot, 'infra-cloudflare'),
+        host.paths.join(workspaceRoot, 'libraries/vibeskit/package.json'),
+        host.paths.join(workspaceRoot, 'apps/cli-bin')
+    ];
+    const deploySensitivePaths = [
+        ...new Set(candidatePaths
+            .filter((path) => isPathWithin(host.paths, repositoryRoot, path))
+            .map((path) => host.paths.relative(repositoryRoot, path) || '.'))
+    ];
+    const result = await runReadOnlyCommand(input.runtime, input.execution, repositoryRoot, [
+        'git',
+        'status',
+        '--porcelain',
+        '--',
+        ...deploySensitivePaths
+    ]);
+    if (result.exitCode !== 0) {
+        return {
+            id: 'clean-worktree',
+            label: 'Clean deploy-sensitive worktree',
+            status: 'unknown',
+            summary: result.error ?? (firstLine(result.stderr) || 'git status could not be read.'),
+            evidence: [`git status --porcelain exited ${result.exitCode}`],
+            action: 'Run the readiness check from a git worktree before treating this candidate as deployable.'
+        };
+    }
+    const changed = parsePorcelain(result.stdout).slice(0, input.maxStatusFiles);
+    if (changed.length > 0) {
+        return {
+            id: 'clean-worktree',
+            label: 'Clean deploy-sensitive worktree',
+            status: 'warn',
+            summary: `${changed.length} deploy-sensitive path(s) have local changes.`,
+            evidence: changed,
+            action: 'Review and commit or isolate deploy-sensitive changes before relying on a production dry-run.'
+        };
+    }
+    return {
+        id: 'clean-worktree',
+        label: 'Clean deploy-sensitive worktree',
+        status: 'pass',
+        summary: 'No local changes detected in deploy-sensitive paths.',
+        evidence: [`repository: ${repositoryRoot}`, ...deploySensitivePaths],
+        action: null
+    };
+}
+export function checkDeploymentConfig(deployment, configLabel) {
+    const hasFrozenInstall = deployment.build.installCommand?.includes('bun install --frozen-lockfile') ?? false;
+    const hasBuildCommand = Boolean(deployment.build.buildCommand?.trim());
+    const hasOutputDir = Boolean(deployment.build.outputDir?.trim());
+    const evidence = [
+        configLabel,
+        hasFrozenInstall ? 'installCommand uses bun install --frozen-lockfile' : 'installCommand is not frozen',
+        hasBuildCommand ? 'buildCommand declared' : 'buildCommand missing',
+        hasOutputDir ? 'outputDir declared' : 'outputDir missing'
+    ];
+    const missing = [
+        !hasFrozenInstall && 'frozen installCommand',
+        !hasBuildCommand && 'buildCommand',
+        !hasOutputDir && 'outputDir'
+    ].filter(Boolean);
+    return {
+        id: 'deployment-config',
+        label: 'Deployment config contract',
+        status: missing.length > 0 ? 'fail' : 'pass',
+        summary: missing.length > 0
+            ? `Missing deploy config contract: ${missing.join(', ')}.`
+            : 'Deployment config declares frozen install, build command, and output directory.',
+        evidence,
+        action: missing.length > 0 ? `Fix ${configLabel} before deploy.` : null
+    };
+}
+/** The registry owns projection of cross-repository workspace selectors during a frozen install. */
+export async function checkLockedWorkspaceSelectors(runtime, repositoryRoot) {
+    const result = await settle(() => inspectRegistryStandaloneSelectors(runtime, repositoryRoot));
+    if (result.ok && result.value === 'not-applicable')
+        return undefined;
+    if (result.ok && result.value === 'unsupported-lock')
+        return {
+            id: 'locked-workspace-selectors', label: 'Locked workspace selectors', status: 'unknown',
+            summary: 'The source repository uses a Bun lock format that cannot be inspected here.', evidence: ['bun.lockb'],
+            action: 'Verify the frozen install through the Registry owner before deploying.'
+        };
+    if (result.ok)
+        return {
+            id: 'locked-workspace-selectors', label: 'Locked workspace selectors', status: 'pass',
+            summary: 'The source repository has locked cross-repository workspace ranges.', evidence: [], action: null
+        };
+    const failure = result.cause;
+    const reason = isCapabilityError(failure) ? failure.reason : undefined;
+    const invalid = reason === 'registry-workspace-version-missing' || reason === 'registry-lock-invalid' ||
+        reason === 'registry-manifest-invalid' || reason === 'registry-workspace-selector-unsupported';
+    return {
+        id: 'locked-workspace-selectors', label: 'Locked workspace selectors', status: invalid ? 'fail' : 'unknown',
+        summary: invalid ? 'The source repository has missing or invalid locked workspace selectors.' : 'Locked workspace selectors could not be verified.',
+        evidence: reason ? [reason] : [],
+        action: 'Regenerate and verify the lock through the Registry owner before deploying.'
+    };
+}
+async function checkVibesKitExports(host, collection, displayBase) {
+    const packagePath = collection
+        ? host.paths.join(collection.root, repositoryGroupRoot(collection.manifest, 'platform'), 'kit', 'package.json')
+        : null;
+    if (!packagePath || !(await host.files.exists(packagePath))) {
+        return {
+            id: 'package-exports',
+            label: 'VibesKit package export contract',
+            status: 'unknown',
+            summary: packagePath
+                ? 'VibesKit package.json is not present in this checkout.'
+                : 'The bound workspace is not a repository collection, so it has no VibesKit checkout.',
+            evidence: packagePath ? [host.paths.relative(displayBase, packagePath) || packagePath] : [],
+            action: 'Run this check from the repository-collection checkout used for deployment.'
+        };
+    }
+    const packageText = await readHostText(host, packagePath);
+    const parsedPackage = await settle(() => z.object({ exports: z.unknown().optional() }).loose().parse(JSON.parse(packageText)));
+    if (!parsedPackage.ok) {
+        throw new CapabilityError('VibesKit package.json is not a valid package object.', 'INVALID_INPUT', {
+            reason: 'package-json-invalid',
+            cause: valueFreeFailure(parsedPackage.cause)
+        });
+    }
+    const pkg = parsedPackage.value;
+    const required = [
+        ['.', ['types', 'import', 'default']],
+        ['./components', ['types', 'svelte', 'import', 'default']],
+        ['./datatable', ['types', 'svelte', 'import', 'default']],
+        ['./pagination/server', ['types', 'import', 'default']],
+        ['./forms/form', ['types', 'import', 'default']]
+    ];
+    const missing = required
+        .filter(([subpath, conditions]) => !packageExportHasConditions(pkg.exports, subpath, conditions))
+        .map(([subpath]) => subpath);
+    return {
+        id: 'package-exports',
+        label: 'VibesKit package export contract',
+        status: missing.length > 0 ? 'fail' : 'pass',
+        summary: missing.length > 0
+            ? `Missing required VibesKit export conditions for ${missing.join(', ')}.`
+            : 'Required VibesKit exports expose packaged types/import/default conditions and isolated Svelte conditions where applicable.',
+        evidence: missing.length > 0 ? missing : required.map(([subpath]) => subpath),
+        action: missing.length > 0
+            ? 'Restore dual export conditions before building system-web.'
+            : null
+    };
+}
+function checkCliDiscovery() {
+    return {
+        id: 'cli-discovery',
+        label: 'Infra CLI discovery',
+        status: 'pass',
+        summary: 'infra deploy readiness command executed through the infra-deploy plugin.',
+        evidence: [
+            'infra-deploy.readiness loader resolved',
+            'expected sibling commands: infra-deploy.run, infra-deploy.list, infra-deploy.regenerate'
+        ],
+        action: null
+    };
+}
+/**
+ * Deployment-module fields only another registered provider consumes: a
+ * provider's descriptor names its own `declarations`, so an app declaring a
+ * field its provider does not own ships configuration nothing will read.
+ */
+export function checkProviderDeclarations(input) {
+    const record = z.record(z.string(), z.unknown()).safeParse(input.raw);
+    const raw = record.success ? record.data : {};
+    const own = new Set(input.providers.find((descriptor) => descriptor.id === input.provider)?.declarations ?? []);
+    // A field counts when it is declared with content: non-empty, not false.
+    const foreign = [...new Set(input.providers
+            .filter((descriptor) => descriptor.id !== input.provider)
+            .flatMap((descriptor) => descriptor.declarations))]
+        .filter((field) => {
+        if (own.has(field) || !Object.hasOwn(raw, field))
+            return false;
+        const value = raw[field];
+        if (value === undefined || value === false)
+            return false;
+        if (Array.isArray(value))
+            return value.length > 0;
+        const subRecord = z.record(z.string(), z.unknown()).safeParse(value);
+        return subRecord.success ? Object.keys(subRecord.data).length > 0 : true;
+    });
+    return {
+        id: 'provider-declarations',
+        label: 'Provider-owned declarations',
+        status: foreign.length > 0 ? 'warn' : 'pass',
+        summary: foreign.length > 0
+            ? `Provider ${input.provider} cannot consume declarations other providers own: ${foreign.join(', ')}.`
+            : `The deployment declares only fields ${input.provider} consumes.`,
+        evidence: foreign.length > 0 ? foreign : [`provider: ${input.provider}`],
+        action: foreign.length > 0 ? 'Remove the declarations or deploy the app through the provider that owns them.' : null
+    };
+}
+/**
+ * The deployed-unit name of every app registered as an `infra/web-app`, by app
+ * id, as its provider names it (`projectWebApp`), for provider topology checks.
+ * The kernel's registry is the only enumeration: an app that declares no
+ * descriptor contributes nothing, and no other app's module is evaluated. One
+ * app's failed projection stays in that app's entry (`unresolved`, value-free
+ * reason) and never fails another app's readiness.
+ */
+async function registeredDeployedUnits(runtime, paths, workspaceRoot, projectionEnvironment) {
+    const units = new Map();
+    const unresolved = new Map();
+    if (!runtime.hasKind('infra/web-app'))
+        return { units, unresolved };
+    for (const descriptor of runtime.query('infra/web-app').descriptors()) {
+        const projected = await settle(() => projectWebApp(runtime, descriptor.id, {
+            appRoot: paths.resolve(workspaceRoot, descriptor.appDir),
+            target: 'production',
+            projectionEnvironment: { ...projectionEnvironment }
+        }));
+        if (!projected.ok) {
+            const cause = projected.cause;
+            unresolved.set(descriptor.deployment.appId, cause instanceof Error && isCapabilityError(cause) ? (cause.reason ?? cause.code) : 'web-app-projection-failed');
+        }
+        else if (projected.value.workerName) {
+            units.set(projected.value.deployment.appId, projected.value.workerName);
+        }
+        else {
+            unresolved.set(descriptor.deployment.appId, 'provider-names-no-unit');
+        }
+    }
+    return { units, unresolved };
+}
+/** Each dependency's deployed unit is registered, or the check names every dependency it could not verify and why. */
+export function checkDependencyUnits(input) {
+    const dependencies = [...new Set(input.deployment.dependsOn.map((dependency) => dependency.appId))];
+    const unverified = dependencies.filter((appId) => !input.units.has(appId));
+    const why = (appId) => `${appId}: ${input.unresolved?.get(appId) ?? 'no registered infra/web-app'}`;
+    return {
+        id: 'dependency-units',
+        label: 'Dependency deployed units',
+        status: unverified.length > 0 ? 'unknown' : 'pass',
+        summary: unverified.length > 0
+            ? `No registered infra/web-app names the deployed unit of ${unverified.join(', ')}; the provider could not check this app's bindings to them.`
+            : dependencies.length > 0
+                ? `Every dependency's deployed unit is registered: ${dependencies.join(', ')}.`
+                : 'The deployment declares no dependencies.',
+        evidence: unverified.length > 0 ? unverified.map(why) : dependencies.map((appId) => `${appId}: ${input.units.get(appId)}`),
+        action: unverified.length > 0
+            ? 'Declare each listed dependency as an infra/web-app descriptor in its own package (<app>.infra.ts).'
+            : null
+    };
+}
+/** The registered deployment providers' descriptors, as their schema reads them. */
+function registeredProviders(runtime) {
+    if (!runtime.hasKind('infra/deployment-provider'))
+        return [];
+    return runtime.query('infra/deployment-provider').descriptors()
+        .map((descriptor) => DeploymentProviderDescriptorSchema.parse(descriptor));
+}
+export async function collectDeployReadinessReport(input) {
+    const configHost = await resolveConfigLoadHost(input.runtime);
+    const appDir = await resolveAppDir(configHost, input.appDir);
+    const located = await locateDeploymentSource(input.runtime, configHost, appDir);
+    const configPath = located.configPath ?? (await findConfigFile(configHost, appDir, located.settings.module));
+    const workspaceRoot = configHost.paths.resolve(input.workspaceRoot);
+    const collection = input.collection === undefined ? await boundCollection(configHost, workspaceRoot) : input.collection;
+    const maxStatusFiles = Math.max(1, Math.min(input.maxStatusFiles ?? 25, 100));
+    const runtime = input.runtime;
+    const execution = input.execution ?? (await resolveRuntimeExecution(runtime));
+    const logger = infraDeployLogger(runtime);
+    const log = {
+        info: (message) => logger.info(message),
+        warn: (message) => logger.warn(message),
+        log: (message) => logger.info(message),
+        error: (message) => logger.error(message)
+    };
+    // The projection is data: when the caller already resolved it (e.g. deploy run),
+    // evaluate under that object; otherwise resolve the provider's environment and
+    // re-evaluate in a fresh process when the provider projects variables into the render.
+    let projectionEnvironment = input.projectionEnvironment ?? {};
+    let loaded = await loadDeploymentConfig(appDir, {
+        runtime,
+        freshProcess: input.freshDeploymentProjection === true,
+        execution,
+        projectionEnvironment
+    });
+    const provider = input.provider ?? loaded.provider;
+    const environment = normalizeDeploymentEnvironment(input.environment);
+    const { implementation } = await resolveDeploymentProvider(runtime, provider);
+    if (input.projectionEnvironment === undefined) {
+        const providerEnvironment = await implementation.environment({
+            environment,
+            credentialSource: 'secrets-store',
+            log
+        });
+        if (providerEnvironment.projected) {
+            projectionEnvironment = providerEnvironment.variables;
+            loaded = await loadDeploymentConfig(appDir, {
+                runtime,
+                freshProcess: true,
+                execution,
+                projectionEnvironment
+            });
+        }
+    }
+    const { units, unresolved } = await registeredDeployedUnits(runtime, configHost.paths, workspaceRoot, projectionEnvironment);
+    const inspection = await implementation.inspect({
+        appDir,
+        configPath,
+        displayBase: input.displayBase,
+        deployment: loaded.deployment,
+        module: deploymentModuleEvaluation(loaded),
+        environment,
+        units,
+        log
+    });
+    const environmentResolution = resolveDeploymentEnvironment({
+        deployment: loaded.deployment,
+        facts: DeploymentEnvironmentFactsSchema.parse(inspection.facts),
+        environment,
+        runtimeEnvironments: runtimeEnvironmentDescriptors(runtime)
+    });
+    const sourceRoot = await settle(() => resolveGitRepositoryRoot(runtime, execution, appDir));
+    const lockedSelectors = sourceRoot.ok && sourceRoot.value
+        ? await checkLockedWorkspaceSelectors(runtime, sourceRoot.value)
+        : undefined;
+    const checks = [
+        checkCliDiscovery(),
+        await checkWorktree({ execution, runtime, workspaceRoot, appDir, maxStatusFiles }),
+        checkDeploymentConfig(loaded.deployment, configHost.paths.relative(input.displayBase, configPath) || configPath),
+        ...(lockedSelectors ? [lockedSelectors] : []),
+        checkDeploymentEnvironment(environmentResolution),
+        ...inspection.checks.map((check) => DeploymentReadinessCheckSchema.parse(check)),
+        checkDependencyUnits({ deployment: loaded.deployment, units, unresolved }),
+        await checkVibesKitExports(configHost, collection, input.displayBase),
+        checkProviderDeclarations({ provider, raw: loaded.raw, providers: registeredProviders(runtime) })
+    ];
+    return {
+        appDir,
+        appPath: configHost.paths.relative(workspaceRoot, appDir) || '.',
+        environment: environmentResolution.environment,
+        generatedAt: (input.now ?? new Date()).toISOString(),
+        environmentResolution,
+        summary: summarize(checks),
+        checks
+    };
+}
+/**
+ * Readiness for every registered app of the bound workspace's repository
+ * collection that declares a deployment config. The apps come from the
+ * collection's manifest (`@vibesdotdev/config/repository-collection`), never
+ * from listing a directory.
+ */
+export async function collectDeployReadinessFleetReport(input) {
+    const configHost = await resolveConfigLoadHost(input.runtime);
+    const collection = await readRepositoryCollection(configHost, input.workspaceRoot);
+    const workspaceRoot = collection.root;
+    const runtime = input.runtime;
+    const execution = input.execution ?? (await resolveRuntimeExecution(runtime));
+    const now = input.now ?? new Date();
+    const reports = [];
+    const appDirs = registeredAppCheckouts(configHost, collection).sort((a, b) => a.localeCompare(b));
+    for (const appDir of appDirs) {
+        if (!(await declaresDeployment(runtime, configHost, appDir)))
+            continue;
+        const reportOutcome = await settle(() => collectDeployReadinessReport({
+            appDir,
+            workspaceRoot,
+            displayBase: input.displayBase,
+            collection,
+            environment: input.environment,
+            maxStatusFiles: input.maxStatusFiles,
+            now,
+            runtime,
+            execution
+        }));
+        if (reportOutcome.ok) {
+            reports.push(reportOutcome.value);
+        }
+        else if (!(reportOutcome.cause instanceof NonDeployableDeploymentConfigError)) {
+            throw reportOutcome.cause;
+        }
+    }
+    return {
+        workspaceRoot,
+        environment: input.environment ?? 'production',
+        generatedAt: now.toISOString(),
+        summary: {
+            apps: reports.length,
+            passing: reports.filter((report) => report.summary.status === 'pass').length,
+            warnings: reports.filter((report) => report.summary.status === 'warn').length,
+            failures: reports.filter((report) => report.summary.status === 'fail').length,
+            unknown: reports.filter((report) => report.summary.status === 'unknown').length
+        },
+        reports
+    };
+}
+function statusGlyph(status) {
+    switch (status) {
+        case 'pass':
+            return 'OK';
+        case 'warn':
+            return 'WARN';
+        case 'fail':
+            return 'FAIL';
+        case 'unknown':
+            return 'UNKNOWN';
+    }
+}
+export function validateReadinessScope(path, all) {
+    if (all && path) {
+        throw new CapabilityError('Pass either a path or --all, not both.', 'INVALID_INPUT');
+    }
+}
+export function ensureFleetReadiness(fleet) {
+    if (fleet.summary.failures === 0)
+        return;
+    throw new CapabilityError(`Deploy readiness fleet failed: ${fleet.summary.failures} app(s) have failing checks.`, 'UNAVAILABLE', { details: fleet.summary, recoveryHint: 'Resolve the failing app reports before deploying.' });
+}
+export function fleetTextLines(fleet) {
+    return [
+        `Deploy readiness fleet (${fleet.environment}): ${fleet.summary.apps} apps, ${fleet.summary.failures} failing, ${fleet.summary.warnings} warning`,
+        ...fleet.reports.map((report) => `  ${statusGlyph(report.summary.status)} ${report.appPath}: ${report.summary.failures} failing, ${report.summary.warnings} warning`)
+    ];
+}
+export default {
+    async execute(args, opts, context) {
+        const { runtime } = context;
+        const cwd = requireRuntimeCwd(runtime);
+        const ui = await runtime.context('cli/ui');
+        const output = readString(opts.output) ?? 'table';
+        const all = opts.all === true;
+        validateReadinessScope(readString(args.path), all);
+        const workspaceRoot = await runtime.context('runtime/workspace-path');
+        const displayBase = cwd;
+        if (all) {
+            const fleet = await collectDeployReadinessFleetReport({
+                workspaceRoot,
+                displayBase,
+                environment: readString(opts.environment),
+                maxStatusFiles: readNumber(opts.maxStatusFiles),
+                runtime
+            });
+            if (output === 'json')
+                ui.json(fleet);
+            else if (output === 'table') {
+                ui.table(fleet.reports.map((report) => ({
+                    status: report.summary.status,
+                    app: report.appPath,
+                    passing: report.summary.passing,
+                    warnings: report.summary.warnings,
+                    failures: report.summary.failures,
+                    unknown: report.summary.unknown
+                })), { columns: ['status', 'app', 'passing', 'warnings', 'failures', 'unknown'] });
+            }
+            else
+                for (const line of fleetTextLines(fleet))
+                    ui.log(line);
+            ensureFleetReadiness(fleet);
+            return;
+        }
+        const paths = await getRuntimePath(runtime);
+        const report = await collectDeployReadinessReport({
+            appDir: paths.resolve(cwd, readString(args.path) ?? '.'),
+            workspaceRoot,
+            displayBase,
+            environment: readString(opts.environment),
+            maxStatusFiles: readNumber(opts.maxStatusFiles),
+            runtime
+        });
+        // Render the report first (so the operator/JSON consumer always sees the
+        // full readiness detail), then let a failing verdict propagate as a coded
+        // error the surface projects into the exit code + envelope. Note the JSON
+        // branch previously `return`ed before the exit-code check, so `--output
+        // json` silently exited 0 even with failing checks — throwing after the
+        // render closes that exit-0-on-error hole for both output modes.
+        if (output === 'json') {
+            ui.json(report);
+        }
+        else if (output === 'table') {
+            ui.table(report.checks.map((check) => ({
+                status: check.status,
+                check: check.label,
+                summary: check.summary,
+                action: check.action ?? '-'
+            })), { columns: ['status', 'check', 'summary', 'action'] });
+        }
+        else {
+            ui.info(`Deploy readiness for ${report.appPath} (${report.environment}): ${report.summary.status}`);
+            for (const check of report.checks) {
+                ui.log(`  ${statusGlyph(check.status)} ${check.label}: ${check.summary}`);
+                if (check.action)
+                    ui.log(`    action: ${check.action}`);
+            }
+        }
+        if (report.summary.failures > 0) {
+            throw new CapabilityError(`Deploy readiness for ${report.appPath} (${report.environment}) failed: ${report.summary.failures} check(s) failing.`, 'UNAVAILABLE', {
+                details: {
+                    appPath: report.appPath,
+                    environment: report.environment,
+                    summary: report.summary
+                },
+                recoveryHint: 'Resolve the failing checks listed above before deploying.'
+            });
+        }
+    }
+};
+//# sourceMappingURL=infra-deploy.readiness.cli-command.impl.js.map