@wujiland/cli 0.0.0-stage → 1.0.0

package/README.md

@@ -1,3 +1,13 @@
-# Temporary Holding Version
+# cli
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+**Built** (A6.1). Spec: `docs/specs/06-cli.md`. Change: `openspec/changes/archive/2026-11-15-build-cli/`.
+
+`inca`: the command line for the whole life of an app, published as `@wujiland/cli`.
+
+- `npm run build -w cli` compiles `src/` to `dist/`; `bin` is `dist/bin.js` (plain `node`).
+- `npm test -w cli` covers every acceptance line of `06-cli.md` §10 and `08-ci.md` §10 lines 7, 8, 10,
+  with fakes for `gh`, `cloudflared`, the keychain, the manager and the broker. No token, no network.
+- Line 11 also runs `inca-infra`'s `check_gate` when a clone with its venv is found
+  (`INCA_INFRA_DIR`, default `../inca-infra`); otherwise it is skipped.
+- On Man Hay's machine: `npm link -w cli`, then
+  `inca login --manager https://manager.<domain> --github-user <account>`.

package/dist/app.d.ts

@@ -0,0 +1,16 @@
+import type { Config, ConfigError } from "@wujiland/config";
+import type { Deps } from "./context.js";
+export declare const CONFIG_FILE = "inca.config.yaml";
+export declare function readText(path: string, what: string): Promise<string>;
+export declare function migrationFiles(dir: string): Promise<string[]>;
+export declare function formatErrors(errors: ConfigError[]): string[];
+export type LoadedApp = {
+    dir: string;
+    text: string;
+    config: Config;
+    migrations: string[];
+};
+export declare function loadApp(dir: string): Promise<LoadedApp>;
+/** A rendered wrangler.jsonc must never be committable (INCA-07). */
+export declare function requireIgnored(deps: Deps, dir: string, file: string): Promise<void>;
+export declare function isTracked(deps: Deps, dir: string, file: string): Promise<boolean>;

package/dist/app.js

@@ -0,0 +1,59 @@
+// The app repo on disk: its config, its migrations, and the renderer run over them (02-renderer.md §3).
+import { readdir, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { parseConfig } from "@wujiland/config";
+import { CliError, EXIT } from "./context.js";
+import { git } from "./github.js";
+export const CONFIG_FILE = "inca.config.yaml";
+export async function readText(path, what) {
+    try {
+        return await readFile(path, "utf8");
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            throw new CliError(EXIT.NOT_FOUND, "FILE_NOT_FOUND", `${what} not found: ${path}.`);
+        throw e;
+    }
+}
+export async function migrationFiles(dir) {
+    try {
+        return (await readdir(join(dir, "migrations"))).filter((f) => f.endsWith(".sql")).sort();
+    }
+    catch (e) {
+        if (e.code === "ENOENT")
+            return [];
+        throw e;
+    }
+}
+export function formatErrors(errors) {
+    return errors.map((e) => `${e.code}  ${e.path || "/"}  ${e.message}`);
+}
+export async function loadApp(dir) {
+    const text = await readText(join(dir, CONFIG_FILE), CONFIG_FILE);
+    const migrations = await migrationFiles(dir);
+    const parsed = parseConfig(text, { migrationFiles: migrations });
+    if (!parsed.ok) {
+        throw new CliError(EXIT.REFUSED, "CONFIG_INVALID", `${CONFIG_FILE} has ${parsed.errors.length} error(s):\n  ${formatErrors(parsed.errors).join("\n  ")}`, "inca config check", {
+            errors: parsed.errors,
+        });
+    }
+    return { dir, text, config: parsed.value, migrations };
+}
+/** A rendered wrangler.jsonc must never be committable (INCA-07). */
+export async function requireIgnored(deps, dir, file) {
+    const r = await git(deps, dir, ["check-ignore", "-q", "--", file]);
+    if (r.code === 0)
+        return;
+    if (r.code === 1) {
+        throw new CliError(EXIT.REFUSED, "RENDER_NOT_IGNORED", `${file} is not git-ignored here; a rendered file must never be committed (INCA-07).`, `Add ${file} to .gitignore.`);
+    }
+    throw new CliError(EXIT.REFUSED, "GIT_REPO_REQUIRED", `${dir} is not inside a git work tree.`, "Run this in the app's repository.");
+}
+export async function isTracked(deps, dir, file) {
+    const r = await git(deps, dir, ["ls-files", "--error-unmatch", "--", file]);
+    if (r.code === 0)
+        return true;
+    if (r.code === 1)
+        return false;
+    throw new CliError(EXIT.REFUSED, "GIT_REPO_REQUIRED", `${dir} is not inside a git work tree.`, "Run this in the app's repository.");
+}

package/dist/auth.d.ts

@@ -0,0 +1,19 @@
+import type { Deps } from "./context.js";
+export type TokenInfo = {
+    exp: number | null;
+};
+/** Decodes (does not verify: the manager does) to read the expiry and refuse what is not a JWT. */
+export declare function readJwt(token: string): TokenInfo;
+export declare function checkTool(deps: Deps, tool: string, args: string[], install: string): Promise<void>;
+export declare const INSTALL: {
+    cloudflared: string;
+    gh: string;
+    git: string;
+    wrangler: string;
+    security: string;
+};
+/** `cloudflared access login`, then `cloudflared access token`; login's own output (which holds the token) is discarded. */
+export declare function fetchAccessToken(deps: Deps, appUrl: string): Promise<string>;
+/** Through `security -i` so the token travels on stdin, not in the process list. */
+export declare function storeToken(deps: Deps, account: string, token: string): Promise<void>;
+export declare function loadToken(deps: Deps, account: string): Promise<string>;

package/dist/auth.js

@@ -0,0 +1,81 @@
+import { CliError, EXIT } from "./context.js";
+const SERVICE = "inca";
+const JWT_PART = /^[A-Za-z0-9_-]+$/;
+/** Decodes (does not verify: the manager does) to read the expiry and refuse what is not a JWT. */
+export function readJwt(token) {
+    const parts = token.split(".");
+    if (parts.length !== 3 || !parts.every((p) => JWT_PART.test(p))) {
+        throw new CliError(EXIT.OUTSIDE, "TOKEN_MALFORMED", "cloudflared did not return an Access token.");
+    }
+    let payload;
+    try {
+        payload = JSON.parse(Buffer.from(parts[1], "base64url").toString("utf8"));
+    }
+    catch {
+        throw new CliError(EXIT.OUTSIDE, "TOKEN_MALFORMED", "The Access token's payload is not JSON.");
+    }
+    const exp = payload.exp;
+    return { exp: typeof exp === "number" ? exp : null };
+}
+export async function checkTool(deps, tool, args, install) {
+    try {
+        await deps.run(tool, args);
+    }
+    catch (e) {
+        if (e instanceof CliError && e.code === "TOOL_MISSING")
+            throw new CliError(EXIT.OUTSIDE, "TOOL_MISSING", `${tool} is not installed.`, install);
+        throw e;
+    }
+}
+export const INSTALL = {
+    cloudflared: "brew install cloudflared",
+    gh: "brew install gh, then gh auth login for the account you named at inca login",
+    git: "xcode-select --install (or brew install git)",
+    wrangler: "npm ci in the app repo (wrangler is a dev dependency)",
+    security: "the macOS security tool ships with macOS",
+};
+/** `cloudflared access login`, then `cloudflared access token`; login's own output (which holds the token) is discarded. */
+export async function fetchAccessToken(deps, appUrl) {
+    await checkTool(deps, "cloudflared", ["--version"], INSTALL.cloudflared);
+    const login = await deps.run("cloudflared", ["access", "login", appUrl]);
+    if (login.code !== 0)
+        throw new CliError(EXIT.OUTSIDE, "CLOUDFLARED_FAILED", `cloudflared access login exited ${login.code}.`, "Finish the browser sign-in, then run inca login again.");
+    const r = await deps.run("cloudflared", ["access", "token", `-app=${appUrl}`]);
+    if (r.code !== 0)
+        throw new CliError(EXIT.OUTSIDE, "CLOUDFLARED_FAILED", `cloudflared access token exited ${r.code}.`);
+    const token = r.stdout.trim();
+    readJwt(token);
+    return token;
+}
+function keychainUnsupported() {
+    return new CliError(EXIT.AUTH, "KEYCHAIN_UNSUPPORTED", "The OS keychain is supported on macOS only.", "Set INCA_TOKEN in the environment from `cloudflared access token -app=<manager URL>`.");
+}
+/** Through `security -i` so the token travels on stdin, not in the process list. */
+export async function storeToken(deps, account, token) {
+    if (deps.platform !== "darwin")
+        throw keychainUnsupported();
+    readJwt(token);
+    await checkTool(deps, "security", ["-h"], INSTALL.security);
+    const r = await deps.run("security", ["-i"], { input: `add-generic-password -U -s ${SERVICE} -a ${account} -w "${token}"\n` });
+    if (r.code !== 0)
+        throw new CliError(EXIT.OUTSIDE, "KEYCHAIN_FAILED", `security exited ${r.code} while storing the token.`);
+}
+export async function loadToken(deps, account) {
+    const fromEnv = deps.env.INCA_TOKEN;
+    let token;
+    if (fromEnv !== undefined && fromEnv !== "") {
+        token = fromEnv.trim();
+    }
+    else {
+        if (deps.platform !== "darwin")
+            throw keychainUnsupported();
+        const r = await deps.run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]);
+        if (r.code !== 0)
+            throw new CliError(EXIT.AUTH, "NOT_LOGGED_IN", "No Access token in the keychain.", "inca login");
+        token = r.stdout.trim();
+    }
+    const { exp } = readJwt(token);
+    if (exp !== null && exp * 1000 <= deps.now())
+        throw new CliError(EXIT.AUTH, "TOKEN_EXPIRED", "The Access session has expired.", "inca login");
+    return token;
+}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,4 @@
+#!/usr/bin/env node
+import { main } from "./main.js";
+import { nodeDeps } from "./node.js";
+process.exitCode = await main(process.argv.slice(2), nodeDeps());

package/dist/commands/access.d.ts

@@ -0,0 +1,14 @@
+import type { Ctx, Outcome } from "../context.js";
+export type Declared = {
+    type: "private" | "named" | "public";
+    emails: string[];
+    bypass_paths: string[];
+};
+/** The module calls of inca-infra/docs/access-model.md §4.4 for one app; null for a plain private app. */
+export declare function renderTerraform(slug: string, d: Declared): string | null;
+export declare function renderRecord(slug: string, domain: string, d: Declared): string;
+/** Missing, dirty or behind its remote → refused (06-cli.md §8). */
+export declare function checkInfra(ctx: Ctx, infraDir: string): Promise<string>;
+export declare function accessRequest(ctx: Ctx): Promise<Outcome>;
+export declare function decommission(ctx: Ctx): Promise<Outcome>;
+export declare function purge(ctx: Ctx): Promise<Outcome>;

package/dist/commands/access.js

@@ -0,0 +1,201 @@
+// inca access request, decommission, purge: the manager's part, then the local inca-infra clone or gh.
+// Writes Terraform and commits it on a branch; never pushes main, never applies (INCA-11, 06-cli.md §4).
+import { access as fsAccess, mkdir, realpath, rm, writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { loadApp } from "../app.js";
+import { CliError, EXIT, confirmTyped, list, str, usage } from "../context.js";
+import { appRepo, firstLine, ghFor, git, gitOk } from "../github.js";
+import { managerClient } from "../manager.js";
+import { requireCliConfig } from "../store.js";
+import { pendingFrom } from "./ops.js";
+import { SLUG } from "./create.js";
+async function exists(path) {
+    try {
+        await fsAccess(path);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+const sorted = (xs) => [...xs].sort();
+const same = (a, b) => JSON.stringify(sorted(a)) === JSON.stringify(sorted(b));
+/** One literal HCL string; anything that could interpolate or escape is refused, not escaped. */
+function hclString(s) {
+    if (/[\\"\n\r]|\$\{|%\{/.test(s))
+        throw new CliError(EXIT.REFUSED, "ACCESS_VALUE_INVALID", `${JSON.stringify(s)} cannot be written into Terraform.`);
+    return `"${s}"`;
+}
+const hclList = (xs) => `[${sorted(xs).map(hclString).join(", ")}]`;
+/** The module calls of inca-infra/docs/access-model.md §4.4 for one app; null for a plain private app. */
+export function renderTerraform(slug, d) {
+    const id = slug.replace(/-/g, "_");
+    const blocks = [];
+    const call = (suffix, module, extra) => [`module "${id}_${suffix}" {`, `  source = "../modules/${module}"`, `  gate   = var.gate`, `  slug   = ${hclString(slug)}`, ...extra, "}"].join("\n");
+    if (d.type === "named")
+        blocks.push(call("named", "named", [`  emails = ${hclList(d.emails)}`]));
+    if (d.type === "public")
+        blocks.push(call("public", "public", []));
+    if (d.type !== "public" && d.bypass_paths.length)
+        blocks.push(call("bypass", "path-bypass", [`  paths  = ${hclList(d.bypass_paths)}`]));
+    if (!blocks.length)
+        return null;
+    return `# Written by inca access request from ${slug}'s inca.config.yaml. Not applied until Man Hay applies it.\n${blocks.join("\n\n")}\n`;
+}
+export function renderRecord(slug, domain, d) {
+    return [
+        `# terraform/apps/${slug}.access.yaml — what the app's inca.config.yaml declares. Not applied state.`,
+        `slug: ${slug}`,
+        `host: ${slug}.${domain}`,
+        `type: ${d.type}`,
+        `emails: ${JSON.stringify(d.type === "named" ? sorted(d.emails) : [])}`,
+        `bypass_paths: ${JSON.stringify(sorted(d.bypass_paths))}`,
+        "",
+    ].join("\n");
+}
+/** Missing, dirty or behind its remote → refused (06-cli.md §8). */
+export async function checkInfra(ctx, infraDir) {
+    const { deps } = ctx;
+    const dir = resolve(deps.cwd, infraDir);
+    if (!(await exists(join(dir, "terraform", "modules", "named"))) || !(await exists(join(dir, "terraform", "apps")))) {
+        throw new CliError(EXIT.REFUSED, "INFRA_MISSING", `No inca-infra clone at ${dir}.`, "Clone inca-infra there, pass --infra <dir>, or save it with inca login --infra <dir>.");
+    }
+    const top = await git(deps, dir, ["rev-parse", "--show-toplevel"]);
+    if (top.code !== 0 || (await realpath(top.stdout.trim())) !== (await realpath(dir)))
+        throw new CliError(EXIT.REFUSED, "INFRA_MISSING", `${dir} is not the top of a git clone.`);
+    const dirty = await gitOk(deps, dir, ["status", "--porcelain"]);
+    if (dirty.stdout.trim() !== "")
+        throw new CliError(EXIT.REFUSED, "INFRA_DIRTY", `The inca-infra clone at ${dir} has uncommitted changes.`, "Commit or discard them first.");
+    await gitOk(deps, dir, ["fetch", "origin"]);
+    const behind = await git(deps, dir, ["rev-list", "--count", "HEAD..@{upstream}"]);
+    if (behind.code !== 0)
+        throw new CliError(EXIT.REFUSED, "INFRA_NO_UPSTREAM", `The inca-infra clone's branch has no upstream: ${firstLine(behind.stderr)}`, "git switch main");
+    if (Number(behind.stdout.trim()) > 0)
+        throw new CliError(EXIT.REFUSED, "INFRA_BEHIND", `The inca-infra clone is ${behind.stdout.trim()} commit(s) behind its remote.`, "git pull --ff-only");
+    return dir;
+}
+async function infraDirFor(ctx) {
+    const flag = str(ctx.flags, "infra");
+    if (flag !== undefined)
+        return flag;
+    return (await requireCliConfig(ctx.deps)).infra_dir ?? join("..", "inca-infra");
+}
+/** A new branch from origin/main, the files written or removed, one commit. Returns null when nothing changed. */
+async function commitOnBranch(deps, dir, slug, write, message) {
+    const branch = `access/${slug}-${Math.floor(deps.now() / 1000)}`;
+    await gitOk(deps, dir, ["switch", "-c", branch, "--no-track", "refs/remotes/origin/main"]);
+    const appsDir = join(dir, "terraform", "apps");
+    await mkdir(appsDir, { recursive: true });
+    for (const [name, content] of Object.entries(write)) {
+        const path = join(appsDir, name);
+        if (content === null)
+            await rm(path, { force: true });
+        else
+            await writeFile(path, content);
+    }
+    await gitOk(deps, dir, ["add", "-A", "--", "terraform/apps"]);
+    const staged = await git(deps, dir, ["diff", "--cached", "--quiet"]);
+    if (staged.code === 0) {
+        await gitOk(deps, dir, ["switch", "-"]);
+        await gitOk(deps, dir, ["branch", "-D", branch]);
+        return null;
+    }
+    await gitOk(deps, dir, ["commit", "-m", message]);
+    return { branch, sha: (await gitOk(deps, dir, ["rev-parse", "HEAD"])).stdout.trim() };
+}
+/** inca-infra's own gate check, when its venv is there; a refusal undoes the commit. */
+async function runGateCheck(ctx, dir) {
+    const python = join(dir, "scripts", ".venv", "bin", "python");
+    if (!(await exists(python))) {
+        ctx.warn("inca-infra's check_gate was not run here (no scripts/.venv); scripts/plan.sh runs it.");
+        return "not-run";
+    }
+    const r = await ctx.deps.run(python, [join(dir, "scripts", "check_gate.py"), "--root", dir]);
+    if (r.code !== 0) {
+        await gitOk(ctx.deps, dir, ["reset", "--hard", "HEAD~1"]);
+        throw new CliError(EXIT.REFUSED, "GATE_CHECK_REFUSED", `inca-infra's check_gate refused the change:\n${r.stdout.trim()}`, "Nothing was kept; fix the config and run again.");
+    }
+    return "passed";
+}
+export async function accessRequest(ctx) {
+    const slug = ctx.positionals[0];
+    const app = await loadApp(ctx.deps.cwd);
+    if (app.config.name !== slug)
+        throw new CliError(EXIT.REFUSED, "SLUG_MISMATCH", `This directory's config is ${app.config.name}, not ${slug}.`, `Run it in inca-app-${slug}.`);
+    const a = app.config.access ?? {};
+    const config = { type: a.type ?? "private", emails: a.emails ?? [], bypass_paths: a.bypass_paths ?? [] };
+    const named = list(ctx.flags, "named");
+    const kinds = [ctx.flags.public === true && "public", ctx.flags.private === true && "private", named.length > 0 && "named"].filter(Boolean);
+    if (kinds.length > 1)
+        throw usage("Give one of --public, --private, --named.");
+    const asked = kinds[0];
+    // The request must agree with the config; the config is edited first (06-cli.md §5).
+    const disagree = (what, want) => new CliError(EXIT.REFUSED, "ACCESS_REQUEST_DISAGREES", `The request asks for ${what}, but inca.config.yaml declares ${want}.`, "Edit access: in inca.config.yaml first, deploy it, then run inca access request again.", { config: config });
+    if (asked !== undefined && asked !== config.type)
+        throw disagree(`type ${asked}`, `type ${config.type}`);
+    if (named.length && !same(named, config.emails))
+        throw disagree(`emails ${named.join(", ")}`, `emails ${config.emails.join(", ") || "(none)"}`);
+    const bypass = list(ctx.flags, "bypass");
+    if (bypass.length && !same(bypass, config.bypass_paths))
+        throw disagree(`bypass ${bypass.join(", ")}`, `bypass ${config.bypass_paths.join(", ") || "(none)"}`);
+    const dir = await checkInfra(ctx, await infraDirFor(ctx));
+    const m = await managerClient(ctx.deps);
+    const tf = renderTerraform(slug, config);
+    const tfPath = join(dir, "terraform", "apps", `${slug}.tf`);
+    if (tf === null && !(await exists(tfPath))) {
+        return { data: { slug, declared: config, written: [] }, human: [`${slug} is private with no bypass paths: the gate covers it; nothing to request.`] };
+    }
+    const r = await m.call("POST", `/api/v1/apps/${slug}/access/requests`, {});
+    const live = r.declared;
+    if ((live.type ?? "private") !== config.type || !same(live.emails ?? [], config.emails) || !same(live.bypass_paths ?? [], config.bypass_paths)) {
+        throw new CliError(EXIT.REFUSED, "ACCESS_NOT_DEPLOYED", `Production still declares ${JSON.stringify(live)}; this config declares ${JSON.stringify(config)}.`, "Promote the config to production first (inca promote --wait).");
+    }
+    const files = tf === null ? { [`${slug}.tf`]: null, [`${slug}.access.yaml`]: null } : { [`${slug}.tf`]: tf, [`${slug}.access.yaml`]: renderRecord(slug, m.domain, config) };
+    const commit = await commitOnBranch(ctx.deps, dir, slug, files, `Access for ${slug}: ${config.type}${config.bypass_paths.length ? ` + bypass ${sorted(config.bypass_paths).join(" ")}` : ""}`);
+    const gate = commit ? await runGateCheck(ctx, dir) : "not-run";
+    const pending = [
+        { kind: "access-apply", message: `Access for ${slug}.${m.domain} is declared ${config.type} and is not applied until Man Hay applies it (INCA-11).`, next: `cd ${dir} && scripts/plan.sh; Man Hay reviews and runs scripts/apply.sh` },
+    ];
+    return {
+        data: { slug, declared: config, pending_id: r.pending_id, infra: dir, branch: commit?.branch ?? null, commit: commit?.sha ?? null, files: Object.keys(files).map((f) => `terraform/apps/${f}`), check_gate: gate },
+        human: [commit ? `Committed ${Object.keys(files).join(" and ")} on ${commit.branch} in ${dir}.` : "inca-infra already says this; nothing new to commit.", `check_gate: ${gate}.`],
+        pending,
+    };
+}
+export async function decommission(ctx) {
+    const slug = ctx.positionals[0];
+    if (!SLUG.test(slug))
+        throw usage(`${JSON.stringify(slug)} is not an app slug.`);
+    const dir = await checkInfra(ctx, await infraDirFor(ctx));
+    await confirmTyped(ctx, slug);
+    const m = await managerClient(ctx.deps);
+    const r = await m.call("POST", `/api/v1/apps/${slug}/decommission`, { confirm: slug });
+    const files = [`${slug}.tf`, `${slug}.access.yaml`];
+    const present = (await Promise.all(files.map((f) => exists(join(dir, "terraform", "apps", f))))).some(Boolean);
+    const commit = present ? await commitOnBranch(ctx.deps, dir, slug, Object.fromEntries(files.map((f) => [f, null])), `Remove Access for ${slug} (decommissioned)`) : null;
+    const pending = pendingFrom(r.pending);
+    if (commit)
+        pending.push({ kind: "access-removal", message: `The Access removal for ${slug} is committed on ${commit.branch}, not applied.`, next: `cd ${dir} && scripts/plan.sh; Man Hay applies it` });
+    return {
+        data: { slug, removed: r.removed, kept: r.kept, infra_branch: commit?.branch ?? null },
+        human: [`Decommissioned ${slug}: ${r.removed.join(", ") || "nothing live"}.`, `Kept (purge deletes after archiving): ${r.kept.map((k) => `${k.kind} ${k.name}`).join(", ") || "none"}.`],
+        pending,
+    };
+}
+export async function purge(ctx) {
+    const slug = ctx.positionals[0];
+    if (!SLUG.test(slug))
+        throw usage(`${JSON.stringify(slug)} is not an app slug.`);
+    await confirmTyped(ctx, `purge ${slug}`);
+    const m = await managerClient(ctx.deps);
+    const r = await m.call("POST", `/api/v1/apps/${slug}/purge`, { confirm: `purge ${slug}` });
+    if (!r.done)
+        throw new CliError(EXIT.OUTSIDE, "PURGE_INCOMPLETE", "The purge did not finish; nothing listed as kept was deleted.", r.next, { results: r.results });
+    const gh = await ghFor(ctx.deps, m.config.github_user);
+    const full = `${gh.owner}/${appRepo(slug)}`;
+    const view = await gh.ok(["repo", "view", full, "--json", "isArchived"]);
+    const archived = JSON.parse(view.stdout).isArchived === true;
+    if (!archived)
+        await gh.ok(["repo", "archive", full, "--yes"]);
+    return { data: { slug, results: r.results, repository: full, archived: true }, human: [`Purged ${slug}; ${full} archived.`] };
+}

package/dist/commands/ci.d.ts

@@ -0,0 +1,27 @@
+import type { Ctx, Outcome, Pending } from "../context.js";
+export declare const OIDC_AUDIENCE = "inca-deploy";
+/** Declared names only, this environment's prefix only; empty values are listed as missing (08-ci.md §6 step 3). */
+export declare function selectSecrets(declared: string[], env: "uat" | "prod", raw: string | undefined): {
+    secrets: Record<string, string>;
+    missing: string[];
+};
+type BrokerResult = {
+    ok: boolean;
+    code?: string;
+    message?: string;
+    next?: string | null;
+    worker?: string;
+    version_id?: string;
+    url?: string;
+    migrations_applied?: string[];
+    secrets_written?: string[];
+    secrets_missing?: string[];
+    secrets_pruned?: string[];
+    storage_created?: unknown[];
+    storage_detached?: unknown[];
+    pending?: Pending[];
+};
+/** Pending steps first, then the result (08-ci.md §6 step 5, §10 line 10). Names only, never values. */
+export declare function summary(env: string, r: BrokerResult, pending: Pending[]): string;
+export declare function ciDeploy(ctx: Ctx): Promise<Outcome>;
+export {};