@yadurajfleetos/cli 0.1.9 → 0.3.0

package/dist/api.js

@@ -28,9 +28,13 @@ export async function request(method, path, opts = {}) {
         method,
         headers: {
             ...(token ? { authorization: `Bearer ${token}` } : {}),
-            ...(opts.body ? { 'content-type': 'application/json' } : {}),
+            ...(opts.raw
+                ? { 'content-type': opts.raw.contentType }
+                : opts.body
+                    ? { 'content-type': 'application/json' }
+                    : {}),
         },
-        body: opts.body ? JSON.stringify(opts.body) : undefined,
+        body: opts.raw ? opts.raw.data : opts.body ? JSON.stringify(opts.body) : undefined,
         signal: AbortSignal.timeout(20 * 60_000),
     });
     let res;

package/dist/archive.js

@@ -0,0 +1,135 @@
+/**
+ * Packing a build context.
+ *
+ * `build:` used to mean "only via a git push", because a checkout on the
+ * control plane was the one context a build could run against. This sends the
+ * directory instead, so a deploy from a laptop builds the same way a pushed
+ * commit does — and Fleet, which can see the fleet's architectures, builds for
+ * all of them rather than leaving you to notice that the image you made on an
+ * Apple laptop will not start on an amd64 node.
+ */
+import { spawn } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CliError, EXIT } from './api.js';
+/**
+ * Excluded even when no .dockerignore says so.
+ *
+ * These are never part of an image and are the difference between an upload of
+ * a few hundred kilobytes and one of several hundred megabytes. A Dockerfile
+ * that genuinely needs .git is rare enough to be worth an explicit exception
+ * later rather than a slow upload for everybody now.
+ */
+const ALWAYS_EXCLUDE = ['.git', 'node_modules', '.DS_Store'];
+/**
+ * Patterns that must never be honoured, however the .dockerignore is written.
+ *
+ * `Dockerfile` in a .dockerignore is standard, recommended practice: a local
+ * `docker build` reads it from the host rather than from the context, so
+ * excluding it avoids shipping it twice. Here the context is built somewhere
+ * else, and the Dockerfile has to travel with it — honouring that line
+ * produces "failed to read dockerfile" on a context that is otherwise perfect.
+ *
+ * A bare `*` is the other one. It is the whitelist idiom, always paired with
+ * `!keep-this` lines, and since negations are not supported it would otherwise
+ * mean "exclude the entire project".
+ */
+function mustNotExclude(pattern) {
+    const p = pattern.replace(/^\.?\//, '').replace(/^\*\*\//, '');
+    if (p === '*' || p === '**' || p === '.')
+        return true;
+    return /^\*?dockerfile/i.test(p);
+}
+/**
+ * Read .dockerignore into tar exclusion patterns.
+ *
+ * The two formats are close but not identical: .dockerignore has negations
+ * (`!keep-this`) and anchors paths at the context root. Negations are dropped
+ * rather than half-implemented — including a file that should have been
+ * excluded is a slow upload, whereas excluding one that should have been kept
+ * is a broken build, and silently doing the second would be worse.
+ */
+export async function ignorePatterns(dir) {
+    let text = '';
+    try {
+        text = await readFile(join(dir, '.dockerignore'), 'utf8');
+    }
+    catch {
+        return [...ALWAYS_EXCLUDE];
+    }
+    const patterns = text
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#') && !line.startsWith('!'))
+        .map((line) => line.replace(/^\/+/, '').replace(/\/+$/, ''))
+        .filter(Boolean)
+        .filter((line) => !mustNotExclude(line));
+    return [...new Set([...ALWAYS_EXCLUDE, ...patterns])];
+}
+/**
+ * Pack `dir` into a gzipped tar in memory.
+ *
+ * Buffered rather than streamed because the whole thing is POSTed as one body,
+ * and the control plane rejects anything over its limit anyway — a stream would
+ * only defer discovering that until after the upload.
+ */
+export async function packContext(dir) {
+    const excludes = await ignorePatterns(dir);
+    const args = [
+        '-czf',
+        '-',
+        '-C',
+        dir,
+        // Ownership and timestamps vary per machine and would make two packs of the
+        // same tree differ for no reason.
+        '--no-xattrs',
+        ...excludes.flatMap((p) => ['--exclude', p]),
+        '.',
+    ];
+    return new Promise((resolve, reject) => {
+        const child = spawn('tar', args, { stdio: ['ignore', 'pipe', 'pipe'] });
+        const chunks = [];
+        let stderr = '';
+        let settled = false;
+        const fail = (message) => {
+            if (settled)
+                return;
+            settled = true;
+            reject(new CliError(message, EXIT.failure));
+        };
+        child.stdout.on('data', (c) => chunks.push(c));
+        child.stderr.on('data', (c) => (stderr += c.toString()));
+        child.on('error', (err) => fail(`Could not run tar to package the build context: ${err.message}`));
+        child.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (code !== 0) {
+                const detail = stderr.trim().split('\n').slice(-2).join(' ');
+                return reject(new CliError(`Could not package the build context${detail ? `: ${detail}` : ''}`, EXIT.failure));
+            }
+            resolve(Buffer.concat(chunks));
+        });
+    });
+}
+/** For the "uploading 4.2MB" line, so a slow upload says why it is slow. */
+export function humanBytes(bytes) {
+    if (bytes < 1024)
+        return `${bytes}B`;
+    if (bytes < 1024 * 1024)
+        return `${(bytes / 1024).toFixed(0)}kB`;
+    return `${(bytes / 1024 / 1024).toFixed(1)}MB`;
+}
+/**
+ * Pack the directory and hand it to the control plane.
+ *
+ * Returns the id the deploy quotes back, or null when there is nothing to
+ * send — a service deploying a prebuilt `image:` has no context, and uploading
+ * one would be pure waste.
+ */
+export async function uploadContext(serviceId, dir) {
+    const { request } = await import('./api.js');
+    const archive = await packContext(dir);
+    const { body } = await request('POST', `/services/${serviceId}/build-context`, { raw: { data: archive, contentType: 'application/gzip' } });
+    return body;
+}

package/dist/commands/secrets.js

@@ -7,10 +7,22 @@
  * a supported spelling. The value comes from a pipe or from a prompt with the
  * echo off, and nothing here ever prints one back.
  */
+import { readFile } from 'node:fs/promises';
 import { request, requireFleet, CliError, EXIT } from '../api.js';
 import { c, table, relativeTime } from '../render.js';
 import { glyph } from '../ui.js';
 import { askSecret, canPrompt } from '../prompt.js';
+import { parseDotenv } from '../dotenv.js';
+import { declaredSecrets } from '../plan.js';
+/** The manifest in the working directory, if there is one to read. */
+async function declaredSecretsNearby() {
+    try {
+        return declaredSecrets(await readFile('fleet.yaml', 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
 const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
 /**
  * Read the value from a pipe when there is one, otherwise ask for it.
@@ -95,6 +107,99 @@ export const secretsCommand = {
             console.log(c.dim('  takes effect on the next deploy of any service that references it'));
             return;
         }
+        /* ── import ────────────────────────────────────────────────── */
+        if (sub === 'import') {
+            // Reading and choosing happen before anything touches the network, so
+            // `--dry-run` works on a plane, and a typo in a filename is not reported
+            // only after a sign-in prompt.
+            const file = key ?? '.env';
+            let source;
+            try {
+                source = await readFile(file, 'utf8');
+            }
+            catch {
+                throw new CliError(`Cannot read "${file}".\n` +
+                    `  usage: fleet secrets import [file]   (defaults to .env)`, EXIT.usage);
+            }
+            const parsed = parseDotenv(source);
+            for (const skip of parsed.skipped) {
+                console.log(`${glyph.warn} ${c.yellow('skipped')}  line ${skip.line}: ${skip.reason}`);
+            }
+            for (const warning of parsed.warnings) {
+                console.log(`${glyph.warn} ${c.yellow('warning')}  ${warning}`);
+            }
+            if (!parsed.entries.length) {
+                throw new CliError(`No usable assignments in "${file}".`, EXIT.usage);
+            }
+            // Which of them to send. The default is what the manifest declares,
+            // because a .env is half configuration and the store is only for the
+            // other half.
+            const only = typeof flags.only === 'string' ? flags.only.split(',').map((k) => k.trim()) : null;
+            let chosen;
+            let basis;
+            if (only) {
+                const missing = only.filter((k) => !parsed.entries.some((e) => e.key === k));
+                if (missing.length) {
+                    throw new CliError(`Not in ${file}: ${missing.join(', ')}`, EXIT.usage);
+                }
+                chosen = parsed.entries.filter((e) => only.includes(e.key));
+                basis = '--only';
+            }
+            else if (flags.all) {
+                chosen = parsed.entries;
+                basis = '--all';
+            }
+            else {
+                const declared = await declaredSecretsNearby();
+                if (!declared) {
+                    throw new CliError(`No fleet.yaml here to say which keys are secrets.\n` +
+                        `  Pick them:      fleet secrets import ${file} --only KEY,OTHER_KEY\n` +
+                        `  Or send it all: fleet secrets import ${file} --all`, EXIT.usage);
+                }
+                chosen = parsed.entries.filter((e) => declared.has(e.key));
+                basis = 'fleet.yaml';
+                // Named in the manifest but absent from the file: the deploy will be
+                // refused for a missing secret later, so say it now.
+                for (const [name, wanted] of declared) {
+                    if (!parsed.entries.some((e) => e.key === name)) {
+                        console.log(`${glyph.warn} ${c.yellow('missing')}  ${c.bold(name)} is declared by ${wanted.join(', ')} but is not in ${file}`);
+                    }
+                }
+            }
+            if (!chosen.length) {
+                throw new CliError(`Nothing in "${file}" matches ${basis === 'fleet.yaml' ? 'the secrets fleet.yaml declares' : basis}.\n` +
+                    `  Send everything with --all, or name keys with --only KEY,OTHER_KEY`, EXIT.usage);
+            }
+            if (flags['dry-run']) {
+                const scope = service ? ` for ${c.bold(service)}` : '';
+                console.log(`\n  ${c.dim(`would store from ${file}${scope}, chosen by ${basis}`)}\n`);
+                for (const entry of chosen)
+                    console.log(`  ${c.bold(entry.key)} ${c.dim(`(line ${entry.line})`)}`);
+                console.log(c.dim(`\n  ${chosen.length} key(s). No values are shown, here or ever.`));
+                return;
+            }
+            const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
+            const target = service ? await resolveServiceId(fleetId, service) : null;
+            const where = target ? ` for ${c.bold(target.name)}` : '';
+            let stored = 0;
+            let replaced = 0;
+            for (const entry of chosen) {
+                const path = target
+                    ? `/services/${target.id}/secrets/${encodeURIComponent(entry.key)}`
+                    : `/fleets/${fleetId}/secrets/${encodeURIComponent(entry.key)}`;
+                const { body } = await request('PUT', path, { body: { value: entry.value } });
+                if (body.created)
+                    stored++;
+                else
+                    replaced++;
+                console.log(`${glyph.ok} ${c.green(body.created ? 'stored' : 'replaced')}  ${c.bold(entry.key)}${where}`);
+            }
+            const untouched = parsed.entries.length - chosen.length;
+            console.log(c.dim(`\n  ${stored} stored, ${replaced} replaced` +
+                (untouched ? `; ${untouched} other key(s) in ${file} left alone` : '')));
+            console.log(c.dim('  takes effect on the next deploy of any service that references them'));
+            return;
+        }
         /* ── rm ────────────────────────────────────────────────────── */
         if (sub === 'rm' || sub === 'remove' || sub === 'delete') {
             if (!key)
@@ -112,6 +217,10 @@ export const secretsCommand = {
         }
         throw new CliError('usage: fleet secrets [ls]\n' +
             '       fleet secrets set <KEY> [--service <name>]\n' +
-            '       fleet secrets rm  <KEY> [--service <name>]', EXIT.usage);
+            '       fleet secrets rm  <KEY> [--service <name>]\n' +
+            '       fleet secrets import [file] [--all | --only A,B] [--service <name>] [--dry-run]\n' +
+            '\n' +
+            '  import reads a .env (default: ./.env) and stores the keys fleet.yaml\n' +
+            '  declares as secrets. --all sends every key in the file instead.', EXIT.usage);
     },
 };

package/dist/commands/services.js

@@ -6,6 +6,8 @@ import { task, glyph } from '../ui.js';
 import { withLadder } from '../ladder.js';
 import { ask, canPrompt, confirm, selectOrThrow } from '../prompt.js';
 import { DEPLOY_STEPS, follow, phaseWalker, } from '../progress.js';
+import { planFromManifest, projectNameFor } from '../plan.js';
+import { uploadContext, humanBytes } from '../archive.js';
 const manifestPath = (given) => given ?? 'fleet.yaml';
 async function readManifest(path) {
     try {
@@ -38,10 +40,12 @@ export const applyCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
         const manifest = await readManifest(manifestPath(args[0]));
-        const body = await task(`applying ${manifestPath(args[0])}`, async () => (await request('POST', `/fleets/${fleetId}/services`, { body: { manifest } })).body, {
+        const body = await task(`applying ${manifestPath(args[0])}`, async () => (await request('POST', `/fleets/${fleetId}/services`, {
+            body: { manifest, project: projectNameFor(process.cwd()) },
+        })).body, {
             done: (b) => b.created.length || b.updated.length
-                ? `applied ${b.created.length + b.updated.length} service(s)`
-                : 'no changes',
+                ? `applied ${b.created.length + b.updated.length} service(s) to project ${b.project}`
+                : `no changes in project ${b.project}`,
         });
         if (flags.json)
             return console.log(JSON.stringify(body, null, 2));
@@ -69,14 +73,29 @@ export const servicesCommand = {
             return console.log(JSON.stringify(body.services, null, 2));
         if (!body.services.length)
             return console.log('No services. Run `fleet apply` with a fleet.yaml.');
-        console.log(table(['service', 'url', 'placement', 'node', 'sha', 'status'], body.services.map((s) => [
-            s.name + (s.persistentVolume ? c.dim(' ⛁') : ''),
-            s.domain ?? s.hostname ?? c.dim('—'),
-            s.placementPolicy,
-            s.current?.nodeName ?? c.dim('—'),
-            s.current?.gitSha?.slice(0, 7) ?? c.dim('—'),
-            s.current ? statusColour(s.current.status) : c.dim('not deployed'),
-        ])));
+        // Grouped by project. A fleet.yaml describes a stack, and listing its
+        // services flat among somebody else's is how four related things came to
+        // look like four unrelated ones.
+        const byProject = new Map();
+        for (const s of body.services) {
+            const key = s.project || 'default';
+            const group = byProject.get(key) ?? [];
+            group.push(s);
+            byProject.set(key, group);
+        }
+        for (const [project, group] of [...byProject].sort((a, b) => a[0].localeCompare(b[0]))) {
+            const running = group.filter((s) => s.current?.status === 'running').length;
+            const ram = group.reduce((sum, s) => sum + s.requestRamMb, 0);
+            console.log(`\n${c.bold(project)}  ${c.dim(`${running}/${group.length} running · ${mb(ram)}`)}`);
+            console.log(table(['service', 'url', 'placement', 'node', 'sha', 'status'], group.map((s) => [
+                s.name + (s.persistentVolume ? c.dim(' ⛁') : ''),
+                s.domain ?? s.hostname ?? c.dim('—'),
+                s.placementPolicy,
+                s.current?.nodeName ?? c.dim('—'),
+                s.current?.gitSha?.slice(0, 7) ?? c.dim('—'),
+                s.current ? statusColour(s.current.status) : c.dim('not deployed'),
+            ])));
+        }
     },
 };
 async function findService(fleetId, name) {
@@ -154,6 +173,22 @@ async function waitUntilRunning(fleetId, name, timeoutMs = 180_000) {
         throw new CliError(`"${name}" was scheduled but has not reported running. \`fleet deployments ${name}\` has the detail.`, EXIT.healthCheckFailed);
     }, { done: () => `${c.bold(name)} is running` });
 }
+/**
+ * The build context a service declares, if any, read from the local manifest.
+ *
+ * Absent when there is no fleet.yaml here — deploying from outside the
+ * repository is legitimate for a prebuilt `image:` service, and should not
+ * become an error about a file the operator never needed.
+ */
+async function buildContextFor(serviceName) {
+    try {
+        const source = await readFile('fleet.yaml', 'utf8');
+        return planFromManifest(source).find((s) => s.name === serviceName)?.build;
+    }
+    catch {
+        return undefined;
+    }
+}
 export const deployCommand = {
     async run(args, flags) {
         const fleetId = await requireFleet(typeof flags.fleet === 'string' ? flags.fleet : undefined);
@@ -182,13 +217,23 @@ export const deployCommand = {
             console.log(c.dim('Deployment cancelled. Re-run with --yes to skip confirmation.'));
             return;
         }
+        // A service that builds from source needs its directory sent, or the
+        // control plane has nothing to build and says the context does not exist.
+        // Read from the manifest here rather than from the service row, because
+        // the build path is relative to the file the operator is standing in.
+        let contextId;
+        const buildContext = await buildContextFor(service.name);
+        if (buildContext) {
+            const uploaded = await task(`packaging ${c.bold(service.name)}`, async () => uploadContext(service.id, join(process.cwd(), buildContext)), { done: (r) => `uploaded ${humanBytes(r.bytes)} of build context` });
+            contextId = uploaded.contextId;
+        }
         const body = await withLadder(DEPLOY_STEPS, async (ladder) => {
             const walker = phaseWalker(ladder);
             const progress = follow(service.id, (p) => walker.apply(p), {
                 onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
             });
             try {
-                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
+                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha, contextId } })).body;
                 walker.finish(`scheduled onto ${result.placedOn.name}`);
                 return result;
             }

package/dist/commands/up.js

@@ -14,6 +14,8 @@ import { c } from '../render.js';
 import { task, glyph } from '../ui.js';
 import { withLadder } from '../ladder.js';
 import { DEPLOY_STEPS, follow, phaseWalker } from '../progress.js';
+import { planFromManifest, deployOrder, projectNameFor } from '../plan.js';
+import { uploadContext, humanBytes } from '../archive.js';
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 export const upCommand = {
     async run(args, flags) {
@@ -44,78 +46,125 @@ export const upCommand = {
         }
         // ── Step 2: read and apply the manifest ───────────────────────────
         const manifest = await readFile(manifestPath, 'utf8');
-        const applyResult = await task(`applying ${manifestPath}`, async () => (await request('POST', `/fleets/${fleetId}/services`, { body: { manifest } })).body, {
+        const applyResult = await task(`applying ${manifestPath}`, async () => (await request('POST', `/fleets/${fleetId}/services`, {
+            body: { manifest, project: projectNameFor(process.cwd()) },
+        })).body, {
             done: (b) => b.created.length || b.updated.length
-                ? `applied ${b.created.length + b.updated.length} service(s)`
-                : 'no changes',
+                ? `applied ${b.created.length + b.updated.length} service(s) to project ${b.project}`
+                : `no changes in project ${b.project}`,
         });
         for (const w of applyResult.warnings) {
             console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);
         }
-        // ── Step 3: pick the target service ───────────────────────────────
-        const serviceName = args[0] || applyResult.created[0] || applyResult.updated[0];
-        if (!serviceName) {
-            throw new CliError('Could not determine which service to deploy. Pass the name: fleet up <service>', EXIT.usage);
+        // ── Step 3: decide what to deploy, and in what order ──────────────
+        const planned = planFromManifest(manifest);
+        const buildContexts = new Map(planned.map((p) => [p.name, p.build]));
+        // No argument means the whole stack. A manifest describes a system, and
+        // deploying one service of it and leaving the rest was never what anybody
+        // wanted — it just meant typing the command again in the right order.
+        const targets = args[0] ? [args[0]] : deployOrder(planned);
+        if (!targets.length) {
+            throw new CliError('The manifest declares no services to deploy.', EXIT.usage);
         }
-        // Look it up
         const { body: listBody } = await request('GET', `/fleets/${fleetId}/services`);
-        const service = listBody.services.find((s) => s.name === serviceName || s.id === serviceName);
-        if (!service) {
-            throw new CliError(`Service "${serviceName}" not found after apply. Known: ${listBody.services.map((s) => s.name).join(', ')}`, EXIT.usage);
-        }
-        // ── Step 4: deploy ────────────────────────────────────────────────
-        const gitSha = typeof flags.sha === 'string' ? flags.sha : undefined;
-        const deployResult = await withLadder(DEPLOY_STEPS, async (ladder) => {
-            const walker = phaseWalker(ladder);
-            const progress = follow(service.id, (p) => walker.apply(p), {
-                onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
-            });
-            try {
-                const result = (await request('POST', `/services/${service.id}/deploy`, { body: { gitSha } })).body;
-                walker.finish(`scheduled onto ${result.placedOn.name}`);
-                return result;
+        const resolved = targets.map((name) => {
+            const service = listBody.services.find((s) => s.name === name || s.id === name);
+            if (!service) {
+                throw new CliError(`Service "${name}" not found after apply. Known: ${listBody.services.map((s) => s.name).join(', ')}`, EXIT.usage);
             }
-            finally {
-                await progress.stop();
-            }
-        }, {
-            mark: true,
-            title: `deploying ${service.name}`,
-            onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
+            return service;
         });
-        for (const w of deployResult.warnings ?? []) {
-            console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);
+        if (resolved.length > 1) {
+            console.log(`\n  ${c.dim('deploying')} ${resolved.map((s) => c.bold(s.name)).join(c.dim(' → '))}\n`);
         }
-        // ── Step 5: wait for healthy ──────────────────────────────────────
-        if (!flags['no-wait']) {
-            await task(`waiting for ${c.bold(service.name)} to come up`, async (s) => {
-                s.hints([
-                    'the agent picks up desired state on its next poll',
-                    "a cold image pull takes as long as the node's uplink does",
-                    'this clears once the agent reports the container running',
-                ]);
-                const deadline = Date.now() + 180_000;
-                while (Date.now() < deadline) {
-                    const { body } = await request('GET', `/fleets/${fleetId}/services`);
-                    const current = body.services.find((s) => s.id === service.id)?.current;
-                    if (current?.status === 'running')
-                        return;
-                    if (current?.status === 'failed') {
-                        throw new CliError(`"${service.name}" did not start. \`fleet deployments ${service.name}\` has the reason.`, EXIT.healthCheckFailed);
-                    }
-                    await sleep(2000);
-                }
-                throw new CliError(`"${service.name}" was scheduled but has not reported running.`, EXIT.healthCheckFailed);
-            }, { done: () => `${c.bold(service.name)} is running` });
+        const gitSha = typeof flags.sha === 'string' ? flags.sha : undefined;
+        const deployed = [];
+        for (const service of resolved) {
+            const url = await deployOne(service, {
+                fleetId,
+                gitSha,
+                buildContext: buildContexts.get(service.name),
+                wait: !flags['no-wait'],
+            });
+            deployed.push({ service, url });
         }
-        // ── Step 6: print the URL ─────────────────────────────────────────
-        const url = deployResult.url ?? service.domain ?? service.hostname;
-        if (url) {
-            const fullUrl = url.startsWith('http') ? url : `https://${url}`;
+        // ── Step 6: print the URLs ────────────────────────────────────────
+        for (const { service, url } of deployed) {
+            const target = url ?? service.domain ?? service.hostname;
+            if (!target)
+                continue;
+            const fullUrl = target.startsWith('http') ? target : `https://${target}`;
             console.log(`\n${glyph.ok} ${c.green('live')}  ${c.bold(c.cyan(fullUrl))}`);
         }
-        console.log(c.dim(`\n  fleet open ${service.name}   open in browser`));
-        console.log(c.dim(`  fleet logs ${service.name}   follow logs`));
-        console.log(c.dim(`  fleet down ${service.name}   tear down`));
+        const last = deployed[deployed.length - 1]?.service;
+        if (last) {
+            console.log(c.dim(`\n  fleet open ${last.name}   open in browser`));
+            console.log(c.dim(`  fleet logs ${last.name}   follow logs`));
+            console.log(c.dim(`  fleet down ${last.name}   tear down`));
+        }
     },
 };
+/**
+ * Deploy one service: upload its build context if it has one, run the deploy,
+ * and wait for it to report running.
+ *
+ * Returns the URL the control plane handed back, or null for a service that
+ * has none — an internal one, which is reached by name from its neighbours
+ * rather than from outside.
+ */
+async function deployOne(service, opts) {
+    // A service that builds from source sends its directory first. The control
+    // plane then builds it for every architecture the fleet has, which is the
+    // part that is easy to get wrong by hand and silent when you do.
+    let contextId;
+    if (opts.buildContext) {
+        const dir = join(process.cwd(), opts.buildContext);
+        const uploaded = await task(`packaging ${c.bold(service.name)}`, async () => uploadContext(service.id, dir), { done: (r) => `uploaded ${humanBytes(r.bytes)} of build context` });
+        contextId = uploaded.contextId;
+    }
+    const deployResult = await withLadder(DEPLOY_STEPS, async (ladder) => {
+        const walker = phaseWalker(ladder);
+        const progress = follow(service.id, (p) => walker.apply(p), {
+            onUnavailable: () => ladder.note(c.dim('live progress unavailable; continuing with the deploy request')),
+        });
+        try {
+            const result = (await request('POST', `/services/${service.id}/deploy`, {
+                body: { gitSha: opts.gitSha, contextId },
+            })).body;
+            walker.finish(`scheduled onto ${result.placedOn.name}`);
+            return result;
+        }
+        finally {
+            await progress.stop();
+        }
+    }, {
+        mark: true,
+        title: `deploying ${service.name}`,
+        onCancel: `deploy is still running on the control plane; inspect with fleet deployments ${service.name}`,
+    });
+    for (const w of deployResult.warnings ?? []) {
+        console.log(`${glyph.warn} ${c.yellow('warning')}  ${w}`);
+    }
+    if (opts.wait) {
+        await task(`waiting for ${c.bold(service.name)} to come up`, async (s) => {
+            s.hints([
+                'the agent picks up desired state on its next poll',
+                "a cold image pull takes as long as the node's uplink does",
+                'a service with a health check goes running once it passes, not before',
+            ]);
+            const deadline = Date.now() + 180_000;
+            while (Date.now() < deadline) {
+                const { body } = await request('GET', `/fleets/${opts.fleetId}/services`);
+                const current = body.services.find((s) => s.id === service.id)?.current;
+                if (current?.status === 'running')
+                    return;
+                if (current?.status === 'failed') {
+                    throw new CliError(`"${service.name}" did not start. \`fleet deployments ${service.name}\` has the reason.`, EXIT.healthCheckFailed);
+                }
+                await sleep(2000);
+            }
+            throw new CliError(`"${service.name}" was scheduled but has not reported running.`, EXIT.healthCheckFailed);
+        }, { done: () => `${c.bold(service.name)} is running` });
+    }
+    return deployResult.url;
+}

package/dist/dotenv.js

@@ -0,0 +1,103 @@
+/**
+ * Reading a .env file.
+ *
+ * Deliberately not a general dotenv implementation. This one feeds a
+ * credential store, which changes the trade-offs: a value that is silently
+ * altered on the way in fails authentication somewhere far away from here,
+ * with nothing to point back at this file. So the rules are narrow, and
+ * anything ambiguous is reported rather than guessed at.
+ */
+/** The same shape the control plane accepts as an environment variable name. */
+const KEY_PATTERN = /^[A-Z_][A-Z0-9_]{0,127}$/;
+export function parseDotenv(source) {
+    const entries = [];
+    const skipped = [];
+    const warnings = [];
+    const seen = new Set();
+    const lines = source.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i++) {
+        const raw = lines[i];
+        const line = i + 1;
+        const trimmed = raw.trim();
+        if (!trimmed || trimmed.startsWith('#'))
+            continue;
+        // `export FOO=bar` is common in files meant to be sourced by a shell.
+        const withoutExport = trimmed.replace(/^export\s+/, '');
+        const eq = withoutExport.indexOf('=');
+        if (eq < 1) {
+            skipped.push({ line, text: trimmed, reason: 'not a KEY=VALUE assignment' });
+            continue;
+        }
+        const key = withoutExport.slice(0, eq).trim();
+        if (!KEY_PATTERN.test(key)) {
+            skipped.push({ line, text: key, reason: 'not a usable environment variable name' });
+            continue;
+        }
+        const rest = withoutExport.slice(eq + 1);
+        let value;
+        const quote = rest.trimStart()[0];
+        if (quote === '"' || quote === "'") {
+            const body = rest.trimStart();
+            const end = findClosingQuote(body, quote);
+            if (end < 0) {
+                // A multi-line value, or a typo. Either way, do not guess where it ends.
+                skipped.push({ line, text: key, reason: `unterminated ${quote === '"' ? 'double' : 'single'} quote` });
+                continue;
+            }
+            const inner = body.slice(1, end);
+            // Single quotes are literal, as in a shell. Double quotes take the usual
+            // escapes so a value can contain a newline.
+            value = quote === "'" ? inner : unescape(inner);
+        }
+        else {
+            value = rest.trim();
+            // A '#' after whitespace is a comment in most dotenv readers and part of
+            // the password in some. Truncating a credential is the worse mistake, so
+            // this keeps the whole value and says so.
+            if (/\s#/.test(value)) {
+                warnings.push(`${key} (line ${line}) contains " #" and was stored whole, comment included. ` +
+                    `Quote the value if part of it is a comment.`);
+            }
+        }
+        if (seen.has(key)) {
+            // Later wins, as a shell would do, but a duplicate is worth saying aloud:
+            // two different values for one key is rarely intentional.
+            warnings.push(`${key} appears more than once; the value on line ${line} is the one used.`);
+            const previous = entries.findIndex((e) => e.key === key);
+            entries.splice(previous, 1);
+        }
+        seen.add(key);
+        entries.push({ key, value, line });
+    }
+    return { entries, skipped, warnings };
+}
+/** Index of the closing quote, skipping ones that are escaped. */
+function findClosingQuote(body, quote) {
+    for (let i = 1; i < body.length; i++) {
+        if (body[i] === '\\' && quote === '"') {
+            i++;
+            continue;
+        }
+        if (body[i] === quote)
+            return i;
+    }
+    return -1;
+}
+function unescape(input) {
+    return input.replace(/\\(.)/g, (_, ch) => {
+        switch (ch) {
+            case 'n':
+                return '\n';
+            case 'r':
+                return '\r';
+            case 't':
+                return '\t';
+            case '\\':
+                return '\\';
+            case '"':
+                return '"';
+            default:
+                return `\\${ch}`;
+        }
+    });
+}

package/dist/index.js

@@ -15,7 +15,7 @@ const GROUPS = [
     [
         'getting started',
         [
-            ['up [service]', 'Detect, scaffold, apply, and deploy in one command'],
+            ['up [service]', 'Deploy the whole fleet.yaml, in dependency order'],
             ['init', 'Scaffold a fleet.yaml and Dockerfile from this repository'],
             ['config show', 'Show the saved control plane and selected fleet'],
             ['use <fleet>', 'Select the default fleet for later commands'],
@@ -50,6 +50,7 @@ const GROUPS = [
             ['rollback <service> [release]', 'Restore the previous or selected release'],
             ['secrets', 'List the fleet secret store'],
             ['secrets set <KEY>', 'Store a credential; the value is never echoed or logged'],
+            ['secrets import [.env]', 'Store the secrets fleet.yaml declares, read from a .env file'],
             ['secrets rm <KEY>', 'Remove a stored credential'],
             ['nodes cordon <name>', 'Stop scheduling new work onto a node'],
             ['nodes uncordon <name>', 'Allow scheduling again'],

package/dist/plan.js

@@ -0,0 +1,112 @@
+/**
+ * What to deploy, and in what order.
+ *
+ * `fleet up` used to deploy exactly one service, which meant a stack was four
+ * invocations typed in the right order — and getting the order wrong looked
+ * like a broken application rather than a sequencing mistake, because an API
+ * whose database is not up yet fails its health check like any other outage.
+ */
+import { parse as parseYaml } from 'yaml';
+/**
+ * What to call this manifest's services collectively when it does not say.
+ *
+ * The directory name, which is what Compose does and what a person would
+ * answer if asked "which project is this". Normalised to the same shape a
+ * service name has to be, so the server never rejects a name it derived.
+ */
+export function projectNameFor(dir) {
+    const base = dir.split('/').filter(Boolean).pop() ?? 'default';
+    const slug = base
+        .toLowerCase()
+        .replace(/[^a-z0-9-]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48)
+        .replace(/-+$/, '');
+    return slug || 'default';
+}
+/**
+ * Read the manifest the way the control plane will.
+ *
+ * Deliberately forgiving: the server validates, and this only needs enough
+ * structure to decide what to send and when. A manifest that is wrong will be
+ * rejected by apply with a proper message before any of this matters.
+ */
+export function planFromManifest(source) {
+    const doc = parseYaml(source);
+    const services = doc?.services;
+    if (!services || typeof services !== 'object')
+        return [];
+    return Object.entries(services).map(([name, raw]) => {
+        const body = (raw ?? {});
+        return {
+            name,
+            build: typeof body.build === 'string' ? body.build : undefined,
+            affinity: Array.isArray(body.affinity) ? body.affinity.filter((a) => typeof a === 'string') : [],
+        };
+    });
+}
+/**
+ * Which secrets the manifest says it needs, and which services want each.
+ *
+ * A .env holds a mix — half configuration, half credentials — and only the
+ * credentials belong in the secret store. The manifest already draws that line
+ * by declaring `secrets:`, so importing can honour it rather than asking
+ * somebody to re-draw it at the command line.
+ */
+export function declaredSecrets(source) {
+    const doc = parseYaml(source);
+    const services = doc?.services;
+    const declared = new Map();
+    if (!services || typeof services !== 'object')
+        return declared;
+    for (const [name, raw] of Object.entries(services)) {
+        const body = (raw ?? {});
+        if (!Array.isArray(body.secrets))
+            continue;
+        for (const key of body.secrets) {
+            if (typeof key !== 'string')
+                continue;
+            declared.set(key, [...(declared.get(key) ?? []), name]);
+        }
+    }
+    return declared;
+}
+/**
+ * Order services so a dependency is deployed before whatever depends on it.
+ *
+ * `affinity` is the signal. It means "co-locate", not "depends on", but in
+ * practice the two coincide: a service is pinned next to the database it talks
+ * to, and it cannot become healthy until that database answers. Using it for
+ * ordering is a heuristic, and the cost of it being wrong is one slow retry
+ * rather than a failure — the agent's restart policy brings up a container that
+ * started too early anyway.
+ *
+ * Ties keep manifest order, so the file stays the explanation for what happens.
+ * A cycle is not an error here: the services involved are emitted in manifest
+ * order rather than dropped, because refusing to deploy is a worse answer than
+ * deploying in an imperfect order.
+ */
+export function deployOrder(services) {
+    const byName = new Map(services.map((s) => [s.name, s]));
+    const ordered = [];
+    const state = new Map();
+    const visit = (name) => {
+        if (state.get(name) === 'done')
+            return;
+        // Already on the stack: a cycle. Stop rather than recurse forever; the
+        // caller still gets every service, just not in a perfect order.
+        if (state.get(name) === 'visiting')
+            return;
+        const service = byName.get(name);
+        if (!service)
+            return; // affinity on something not in this manifest
+        state.set(name, 'visiting');
+        for (const dependency of service.affinity)
+            visit(dependency);
+        state.set(name, 'done');
+        ordered.push(name);
+    };
+    for (const service of services)
+        visit(service.name);
+    return ordered;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadurajfleetos/cli",
-  "version": "0.1.9",
+  "version": "0.3.0",
   "description": "Fleet OS command-line interface for deploying and orchestrating services on user-owned hardware",
   "type": "module",
   "license": "MIT",