@yunuseon/kayra 0.0.0-stage → 0.4.0

package/cli/dist/commands/server.js

@@ -0,0 +1,215 @@
+import { within, } from "../brand.js";
+import { run } from "../plan.js";
+import { all, err, map, ok } from "../result.js";
+/** The local scripts that read the fleet's files find them here, not beside themselves. */
+const fleetEnv = ({ fleet }) => ({ FLEET_ROOT: fleet });
+const script = ({ kayra }, name) => within(kayra, "scripts", "local", name);
+const ansiblePath = ({ kayra }, ...segments) => within(kayra, "ansible", ...segments);
+const inventory = (server) => within(server.dir, "inventory.ini");
+const terraform = (server) => `-chdir=${within(server.dir, "terraform")}`;
+/** How Ansible gets the vault password: from a file, or by asking. */
+const vaultEnv = (server) => {
+    switch (server.vault.kind) {
+        case "file":
+            return { ANSIBLE_VAULT_PASSWORD_FILE: server.vault.file };
+        case "ask":
+            return { ANSIBLE_ASK_VAULT_PASS: "True" };
+        case "none":
+            return {};
+    }
+};
+const ansibleEnv = (engine, env) => ({ ...env, ANSIBLE_CONFIG: ansiblePath(engine, "ansible.cfg") });
+/** Real servers change only from main as merged; a multipass one from anything. */
+const fromMain = (engine, server) => ({
+    kind: "check",
+    label: `${server.name} may be changed from this checkout`,
+    probe: { kind: "exits-zero", argv: ["bash", script(engine, "require-main.sh"), server.name], env: fleetEnv(engine) },
+    onFailure: "stop",
+});
+/** Before Ansible's UNREACHABLE: why a home machine cannot be reached. */
+const reachable = (engine, server) => server.target === "home"
+    ? [
+        {
+            kind: "check",
+            label: `${server.name} answers over SSH`,
+            probe: {
+                kind: "exits-zero",
+                argv: ["bash", script(engine, "home-reach.sh"), server.name, server.kind],
+                env: fleetEnv(engine),
+            },
+            onFailure: "stop",
+        },
+    ]
+    : [];
+/** The pinned Ansible collections; a no-op once installed. */
+const collections = (engine, env) => ({
+    kind: "run",
+    argv: ["ansible-galaxy", "collection", "install", "-r", ansiblePath(engine, "requirements.yml")],
+    env,
+    stdout: "discard",
+});
+const appSubdomains = (engine, server) => ({
+    kind: "query",
+    argv: ["bash", script(engine, "app-manifests.sh"), "--subdomains", server.name],
+    words: "many",
+    env: fleetEnv(engine),
+});
+const certs = (engine, domain, subdomains) => run(["bash", script(engine, "certs.sh"), domain, within(engine.fleet, ".cache", "certs"), ...subdomains]);
+export const provision = (engine, server) => ok([
+    fromMain(engine, server),
+    ...(server.vm ? [run(["bash", script(engine, "home-image.sh"), server.name], fleetEnv(engine))] : []),
+    ...(server.terraform
+        ? [run(["tofu", terraform(server), "init", "-input=false"]), run(["tofu", terraform(server), "apply", "-auto-approve"])]
+        : []),
+]);
+/** The host layer: the playbook for the server's kind. */
+export const setup = (engine, server) => ok([
+    fromMain(engine, server),
+    // mkcert where Let's Encrypt cannot reach: test VMs, and home servers without DNS-01.
+    ...(server.kind === "platform" && server.target !== "hetzner" && !server.acmeDns
+        ? [certs(engine, server.domain, [appSubdomains(engine, server), ...server.stackHosts])]
+        : []),
+    ...reachable(engine, server),
+    collections(engine, vaultEnv(server)),
+    run([
+        "ansible-playbook",
+        "-i",
+        inventory(server),
+        ansiblePath(engine, "playbooks", `${server.kind}.yml`),
+        "-e",
+        `server=${server.name}`,
+        "-e",
+        `server_dir=${server.dir}`,
+        "-e",
+        `domain=${server.domain}`,
+        "-e",
+        `target=${server.target}`,
+        "-e",
+        `kayra_version=${engine.version}`,
+    ], ansibleEnv(engine, vaultEnv(server))),
+]);
+/** Register every app in server.yml, then remove the rest (their data kept). */
+export const apps = (engine, server) => {
+    const env = vaultEnv(server);
+    const playbook = (name, ...extra) => run(["ansible-playbook", "-i", inventory(server), ansiblePath(engine, "playbooks", name), ...extra], ansibleEnv(engine, env));
+    return ok([
+        fromMain(engine, server),
+        ...(server.kind === "platform"
+            ? [
+                ...server.apps.flatMap((app) => [
+                    collections(engine, env),
+                    playbook("app.yml", "-e", `server=${server.name}`, "-e", `server_dir=${server.dir}`, "-e", `domain=${server.domain}`, "-e", `{"app": ${app.entry}}`),
+                ]),
+                collections(engine, env),
+                playbook("apps-prune.yml", "-e", `{"keep": ${JSON.stringify(server.apps.map((app) => app.name))}}`),
+            ]
+            : []),
+    ]);
+};
+export const hosts = (engine, server) => ok(server.target === "multipass"
+    ? [
+        run([
+            "bash",
+            script(engine, "setup-hosts.sh"),
+            server.domain,
+            { kind: "query", argv: ["tofu", terraform(server), "output", "-raw", "server_ip"], words: "one" },
+            appSubdomains(engine, server),
+        ]),
+    ]
+    : [{ kind: "note", text: `hosts: ${server.target} uses real DNS, nothing to do.` }]);
+const sequence = (plans) => map(all(plans), (each) => each.flat());
+export const deploy = (engine, server) => sequence([setup(engine, server), apps(engine, server)]);
+export const up = (engine, server) => sequence([provision(engine, server), deploy(engine, server), hosts(engine, server)]);
+export const down = (server) => server.terraform
+    ? ok([
+        ...(server.target === "hetzner"
+            ? [
+                {
+                    kind: "confirm",
+                    prompt: `This destroys the Hetzner server '${server.name}' (${server.domain}). Type the name to confirm: `,
+                    expect: server.name,
+                },
+            ]
+            : []),
+        run(["tofu", terraform(server), "destroy", "-auto-approve"]),
+    ])
+    : err(`${server.name} has no terraform/: nothing here creates it, so nothing destroys it`);
+/** Once, for a server we did not create: the deploy user, added as root. */
+export const adopt = (engine, server) => ok([
+    fromMain(engine, server),
+    collections(engine, {}),
+    run(["ansible-playbook", "-i", inventory(server), ansiblePath(engine, "playbooks", "adopt.yml")], ansibleEnv(engine, {})),
+]);
+/** A removed app's volumes: its data, irreversibly. */
+export const appPurge = (engine, server, app) => ok([
+    fromMain(engine, server),
+    run([
+        "ansible",
+        "servers",
+        "-i",
+        inventory(server),
+        "--become",
+        "-m",
+        "ansible.builtin.command",
+        "-a",
+        `/opt/platform/bin/app-purge ${app}`,
+    ], ansibleEnv(engine, {})),
+]);
+/**
+ * The restic-backup role's restore test: the latest backup, restored to a scratch dir and checked.
+ * It runs on the server, detached; kayra follows its log over SSH. Stopping kayra stops only the
+ * following, and running it again while a test runs follows that one instead of starting another.
+ */
+export const backupTest = (engine, server) => {
+    if (server.backupDir === undefined)
+        return err(`${server.name} has no restic_backup.dir in its vars.yml`);
+    if (server.inventory === undefined)
+        return err(`no inventory for '${server.name}' — provision it first.`);
+    return ok([
+        ...reachable(engine, server),
+        run([
+            "ansible",
+            "servers",
+            "-i",
+            inventory(server),
+            "--become",
+            "-e",
+            `@${within(server.dir, "secrets.yml")}`,
+            "-m",
+            "ansible.builtin.command",
+            "-a",
+            `docker compose -f ${server.backupDir}/docker-compose.yml exec -d -T backup /etc/backup/restore-test.sh`,
+        ], ansibleEnv(engine, vaultEnv(server))),
+        { kind: "note", text: "Following the restore test. Ctrl-C stops following, not the test." },
+        run([
+            "ssh",
+            "-p",
+            server.inventory.port,
+            "-i",
+            server.inventory.key,
+            "-o",
+            "StrictHostKeyChecking=accept-new",
+            `${server.inventory.user}@${server.inventory.host}`,
+            "sh",
+            `${server.backupDir}/follow-restore-test.sh`,
+        ]),
+    ]);
+};
+export const ssh = (server) => server.inventory === undefined
+    ? err(`no inventory for '${server.name}' — provision it first.`)
+    : ok([
+        run([
+            "ssh",
+            "-p",
+            server.inventory.port,
+            "-i",
+            server.inventory.key,
+            "-o",
+            "StrictHostKeyChecking=no",
+            "-o",
+            "UserKnownHostsFile=/dev/null",
+            `${server.inventory.user}@${server.inventory.host}`,
+        ]),
+    ]);
+/** mkcert certs for a domain and its subdomains, for local dev and multipass. */
+export const certsFor = (engine, domain, subdomains) => ok([certs(engine, domain, subdomains)]);

package/cli/dist/commands/status.js

@@ -0,0 +1,43 @@
+import { within } from "../brand.js";
+import { capture } from "../interpret.js";
+const describe = (machine) => {
+    switch (machine.kind) {
+        case "none":
+            return "not provisioned";
+        case "provisioned":
+            return `provisioned (${machine.ip ?? "?"})`;
+        case "unreadable":
+            return `state unreadable: ${machine.reason}`;
+    }
+};
+export const statusLine = (server, machine) => [
+    server.name.padEnd(10),
+    `kind=${server.kind.padEnd(9)} target=${server.target.padEnd(10)}`,
+    `domain=${server.domain.padEnd(24)}`,
+    `apps=${server.apps.map((app) => app.name).join(",").padEnd(10)}`,
+    describe(machine),
+].join("  ");
+/** Why tofu could not read the state, in a few words: the first line of its error. */
+export const unreadable = (stderr) => {
+    if (stderr.includes("tofu init"))
+        return "tofu init needed";
+    const line = stderr
+        .split("\n")
+        .map((each) => each.replace(/^[│╷╵\s]+/, "").replace(/^Error:\s*/, "").trim())
+        .find((each) => each !== "");
+    return line ?? "tofu failed";
+};
+const machine = async (server) => {
+    if (!server.terraform)
+        return { kind: "none" };
+    const chdir = `-chdir=${within(server.dir, "terraform")}`;
+    const state = await capture(["tofu", chdir, "state", "list", "-no-color"], "capture");
+    if (state.code !== 0)
+        return { kind: "unreadable", reason: unreadable(state.stderr) };
+    if (state.stdout.trim() === "")
+        return { kind: "none" };
+    const ip = await capture(["tofu", chdir, "output", "-raw", "server_ip"], "capture");
+    return { kind: "provisioned", ip: ip.code === 0 ? ip.stdout.replace(/\n+$/, "") : undefined };
+};
+/** Every server and whether a machine exists for it. Reads state, changes nothing. */
+export const status = async (fleet) => Promise.all(fleet.servers.map(async (server) => statusLine(server, await machine(server))));

package/cli/dist/fleet.js

@@ -0,0 +1,134 @@
+import { parse } from "yaml";
+import { absolutePath, appName, domain, vaultPasswordFile, } from "./brand.js";
+import { all, err, map, ok } from "./result.js";
+export const serverKinds = ["platform", "edge", "nas"];
+export const serverTargets = ["multipass", "hetzner", "home"];
+const mapping = (value) => typeof value === "object" && value !== null && !Array.isArray(value) ? Object.fromEntries(Object.entries(value)) : undefined;
+const fields = (text) => {
+    const value = parse(text);
+    if (value === null)
+        return ok({});
+    const result = mapping(value);
+    return result === undefined ? err("is not a YAML mapping") : ok(result);
+};
+const vaulted = (text) => text.startsWith("$ANSIBLE_VAULT");
+const oneOf = (allowed, value, field) => {
+    const match = allowed.find((candidate) => candidate === value);
+    return match === undefined
+        ? err(`${field} must be ${allowed.join(", ")}, not '${String(value)}'`)
+        : ok(match);
+};
+const vault = (descriptor) => {
+    const file = descriptor["vault_password_file"];
+    if (descriptor["vault"] !== true)
+        return ok({ kind: "none" });
+    if (file === undefined)
+        return ok({ kind: "ask" });
+    return typeof file === "string"
+        ? map(absolutePath(file), (path) => ({ kind: "file", file: vaultPasswordFile(path) }))
+        : err("vault_password_file must be a path");
+};
+/** Apps live in their own repo: Jenkins clones it over HTTPS, and the app root stays inside it. */
+const app = (value) => {
+    const entry = mapping(value);
+    if (entry === undefined)
+        return err("an app must be a mapping");
+    const name = typeof entry["name"] === "string" ? appName(entry["name"]) : err("an app needs a name");
+    if (!name.ok)
+        return name;
+    const repo = entry["repo"];
+    if (typeof repo !== "string" || !repo.startsWith("https://"))
+        return err(`app ${name.value}: repo must be an https:// URL`);
+    const path = entry["path"] ?? ".";
+    if (typeof path !== "string" || `/${path}/`.includes("/../"))
+        return err(`app ${name.value}: path must stay inside its repo`);
+    return ok({ name: name.value, repo, entry: JSON.stringify(value) });
+};
+const inventoryField = (inventory, key) => new RegExp(`${key}=([^ \\n]*)`).exec(inventory)?.[1] ?? "";
+const inventoryOf = (text) => ({
+    host: inventoryField(text, "ansible_host"),
+    port: inventoryField(text, "ansible_port") || "22",
+    user: inventoryField(text, "ansible_user"),
+    key: inventoryField(text, "ansible_ssh_private_key_file"),
+});
+const stackHosts = (stacks, serverDomain) => stacks
+    .flatMap((compose) => [...compose.matchAll(/Host\(`([^`]*)`\)/g)].map((match) => match[1] ?? ""))
+    .map((host) => (host.endsWith(`.${serverDomain}`) ? host.slice(0, -serverDomain.length - 1) : host));
+/** An app's config is plaintext, to be read and diffed; its secrets are vaulted wherever secrets.yml is. */
+const appValuesProblem = (appValues, secretsMustBeVaulted) => appValues
+    .map(({ file, text }) => file.endsWith(".secrets.yml")
+    ? secretsMustBeVaulted && !vaulted(text)
+        ? `apps/${file} must be vault-encrypted`
+        : undefined
+    : vaulted(text)
+        ? `apps/${file} is vault-encrypted; it holds config only — secrets go in apps/${file.replace(/\.yml$/, ".secrets.yml")}`
+        : undefined)
+    .find((problem) => problem !== undefined);
+/** What every command may rely on, checked for every server whenever the fleet loads. */
+export const parseServer = (files) => {
+    const descriptor = fields(files.descriptor);
+    if (!descriptor.ok)
+        return descriptor;
+    const kind = oneOf(serverKinds, descriptor.value["kind"] ?? "platform", "kind");
+    if (!kind.ok)
+        return kind;
+    const target = oneOf(serverTargets, descriptor.value["target"], "target");
+    if (!target.ok)
+        return target;
+    const declared = descriptor.value["domain"];
+    const serverDomain = typeof declared === "string" ? domain(declared) : err("domain is required");
+    if (!serverDomain.ok)
+        return serverDomain;
+    const serverVault = vault(descriptor.value);
+    if (!serverVault.ok)
+        return serverVault;
+    const declaredApps = descriptor.value["apps"] ?? [];
+    if (!Array.isArray(declaredApps))
+        return err("apps must be a list");
+    if (kind.value !== "platform" && declaredApps.length > 0)
+        return err("apps run on platform servers only");
+    const apps = all(declaredApps.map(app));
+    if (!apps.ok)
+        return apps;
+    if (target.value === "home" && files.inventory === undefined)
+        return err("target home needs a hand-written inventory.ini next to it");
+    if (target.value !== "home" && !files.terraform)
+        return err("no terraform/ next to it");
+    if (files.vars === undefined)
+        return err("no vars.yml next to it");
+    if (files.secrets === undefined)
+        return err("no secrets.yml next to it");
+    if (vaulted(files.vars))
+        return err("vars.yml is vault-encrypted; it holds settings only — secrets go in secrets.yml");
+    if (target.value !== "multipass" && serverVault.value.kind === "none")
+        return err(`target ${target.value} requires vault: true`);
+    if (target.value !== "multipass" && !vaulted(files.secrets))
+        return err(`target ${target.value} requires a vault-encrypted secrets.yml`);
+    const appValues = appValuesProblem(files.appValues, target.value !== "multipass");
+    if (appValues !== undefined)
+        return err(appValues);
+    const vars = fields(files.vars);
+    if (!vars.ok)
+        return err(`vars.yml ${vars.error}`);
+    const backupDir = mapping(vars.value["restic_backup"])?.["dir"];
+    return ok({
+        name: files.name,
+        dir: files.dir,
+        kind: kind.value,
+        target: target.value,
+        domain: serverDomain.value,
+        vault: serverVault.value,
+        secretsVaulted: vaulted(files.secrets),
+        apps: apps.value,
+        terraform: files.terraform,
+        vm: target.value === "home" && vars.value["vm"] !== undefined,
+        acmeDns: typeof vars.value["acme_dns"] === "string" && vars.value["acme_dns"] !== "",
+        inventory: files.inventory === undefined ? undefined : inventoryOf(files.inventory),
+        backupDir: typeof backupDir === "string" ? backupDir : undefined,
+        stackHosts: stackHosts(files.stacks, serverDomain.value),
+    });
+};
+export const serverNamed = (fleet, name) => {
+    const server = fleet.servers.find((candidate) => candidate.name === name);
+    return server === undefined ? err(`no server '${name}'`) : ok(server);
+};

package/cli/dist/interpret.js

@@ -0,0 +1,98 @@
+import { spawn } from "node:child_process";
+import { text } from "node:stream/consumers";
+const spawned = async (argv, streams, env = {}) => {
+    const [program, ...args] = argv;
+    const child = spawn(program, args, {
+        env: { ...process.env, ...env },
+        stdio: [
+            "inherit",
+            streams.stdout === "show" ? "inherit" : streams.stdout === "capture" ? "pipe" : "ignore",
+            streams.stderr === "show" ? "inherit" : "pipe",
+        ],
+    });
+    const stdout = child.stdout === null ? Promise.resolve("") : text(child.stdout);
+    const stderr = child.stderr === null ? Promise.resolve("") : text(child.stderr);
+    const exit = await new Promise((resolve) => {
+        child.on("error", resolve);
+        child.on("close", (code) => {
+            resolve(code ?? 1);
+        });
+    });
+    return exit instanceof Error
+        ? { code: 127, stdout: "", stderr: exit.message }
+        : { code: exit, stdout: await stdout, stderr: await stderr };
+};
+/** A command's stdout, for kayra to read; its stderr reaches the operator unless captured too. */
+export const capture = (argv, stderr = "show", env = {}) => spawned(argv, { stdout: "capture", stderr }, env);
+const answer = (probe) => spawned(probe.kind === "on-path" ? ["sh", "-c", 'command -v "$1"', "sh", probe.program] : probe.argv, { stdout: "discard", stderr: "capture" }, probe.kind === "exits-zero" ? probe.env : {});
+/** Each query's answer in place of it, as `$(…)` would: one word, or split into many. Undefined if one failed. */
+const resolve = async (argv, io) => {
+    const words = await Promise.all(argv.map(async (value) => {
+        if (typeof value === "string")
+            return [value];
+        const exit = await capture(value.argv, "show", value.env);
+        if (exit.code !== 0) {
+            io.err(`kayra: ${value.argv.join(" ")} failed (exit ${String(exit.code)})`);
+            return undefined;
+        }
+        const output = exit.stdout.replace(/\n+$/, "");
+        return value.words === "one" ? [output] : output.split(/\s+/).filter((word) => word !== "");
+    }));
+    const [program, ...rest] = words.flatMap((word) => word ?? []);
+    return words.includes(undefined) || program === undefined ? undefined : [program, ...rest];
+};
+const lines = (text) => text
+    .trimEnd()
+    .split("\n")
+    .filter((line) => line !== "");
+const goOn = { failed: false, stopped: false };
+const check = async (step, io) => {
+    const exit = await answer(step.probe);
+    const hint = step.hint === undefined ? [] : [`    → ${step.hint}`];
+    if (step.onFailure === "stop") {
+        if (exit.code === 0)
+            return goOn;
+        [...lines(exit.stderr), ...hint].forEach(io.err);
+        return { failed: true, stopped: true };
+    }
+    if (exit.code === 0) {
+        io.out(`ok    ${step.label}`);
+        return goOn;
+    }
+    [`FAIL  ${step.label}`, ...lines(exit.stderr).map((line) => `    ${line}`), ...hint].forEach(io.out);
+    return { failed: true, stopped: false };
+};
+const perform = async (step, io) => {
+    switch (step.kind) {
+        case "run": {
+            const argv = await resolve(step.argv, io);
+            if (argv === undefined)
+                return { failed: true, stopped: true };
+            const exit = await spawned(argv, { stdout: step.stdout, stderr: "show" }, step.env);
+            return exit.code === 0 ? goOn : { failed: true, stopped: true };
+        }
+        case "check":
+            return check(step, io);
+        case "confirm": {
+            const typed = await io.ask(step.prompt);
+            if (typed === step.expect)
+                return goOn;
+            io.out("Aborted.");
+            return { failed: false, stopped: true };
+        }
+        case "note":
+            io.out(step.text);
+            return goOn;
+    }
+};
+/** Runs a plan step by step, until it ends or a step stops it. True if nothing failed. */
+export const interpret = async (plan, io) => {
+    const outcome = await plan.reduce(async (previous, step) => {
+        const so = await previous;
+        if (so.stopped)
+            return so;
+        const next = await perform(step, io);
+        return { failures: so.failures + (next.failed ? 1 : 0), stopped: next.stopped };
+    }, Promise.resolve({ failures: 0, stopped: false }));
+    return outcome.failures === 0;
+};

package/cli/dist/load.js

@@ -0,0 +1,49 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fleetRoot, serverDir, serverName, within } from "./brand.js";
+import { parseServer } from "./fleet.js";
+import { all, err, map, ok } from "./result.js";
+/** The fleet is the nearest directory, from `from` upwards, with a servers/defaults.yml. */
+export const findFleetRoot = (from) => {
+    if (existsSync(join(from, "servers", "defaults.yml")))
+        return ok(fleetRoot(from));
+    const parent = within(from, "..");
+    return parent === from
+        ? err("no fleet here: no servers/defaults.yml in this directory or above it")
+        : findFleetRoot(parent);
+};
+const text = (path) => (existsSync(path) ? readFileSync(path, "utf8") : undefined);
+const stacks = (dir) => existsSync(join(dir, "stacks"))
+    ? readdirSync(join(dir, "stacks"))
+        .toSorted()
+        .flatMap((stack) => text(join(dir, "stacks", stack, "compose.yaml")) ?? [])
+    : [];
+const appValues = (dir) => existsSync(join(dir, "apps"))
+    ? readdirSync(join(dir, "apps"))
+        .filter((file) => file.endsWith(".yml"))
+        .toSorted()
+        .map((file) => ({ file, text: readFileSync(join(dir, "apps", file), "utf8") }))
+    : [];
+const readServer = (root, entry) => {
+    const name = serverName(entry);
+    if (!name.ok)
+        return err(`servers/${entry}: ${name.error}`);
+    const dir = serverDir(root, name.value);
+    const server = parseServer({
+        name: name.value,
+        dir,
+        descriptor: readFileSync(join(dir, "server.yml"), "utf8"),
+        vars: text(join(dir, "vars.yml")),
+        secrets: text(join(dir, "secrets.yml")),
+        inventory: text(join(dir, "inventory.ini")),
+        terraform: existsSync(join(dir, "terraform")),
+        stacks: stacks(dir),
+        appValues: appValues(dir),
+    });
+    return server.ok ? server : err(`servers/${entry}/server.yml: ${server.error}`);
+};
+export const loadFleet = (root) => map(all(readdirSync(join(root, "servers"), { withFileTypes: true })
+    .filter((entry) => entry.isDirectory() && existsSync(join(root, "servers", entry.name, "server.yml")))
+    .map((entry) => entry.name)
+    .toSorted()
+    .map((entry) => readServer(root, entry))), (servers) => ({ root, servers }));

package/cli/dist/main.js

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+import { run } from "@optique/run";
+import { readFileSync } from "node:fs";
+import { createInterface } from "node:readline/promises";
+import { absolutePath, kayraRoot, kayraVersion, within } from "./brand.js";
+import { parser } from "./cli.js";
+import { doctor } from "./commands/doctor.js";
+import * as server from "./commands/server.js";
+import { status } from "./commands/status.js";
+import { serverNamed } from "./fleet.js";
+import { interpret } from "./interpret.js";
+import { findFleetRoot, loadFleet } from "./load.js";
+import { render } from "./plan.js";
+import { flatMap, ok } from "./result.js";
+const here = absolutePath(process.cwd());
+const engine = absolutePath(import.meta.dirname);
+if (!here.ok || !engine.ok)
+    throw new Error("node reported a relative path");
+const kayra = kayraRoot(within(engine.value, "..", ".."));
+const manifest = JSON.parse(readFileSync(within(kayra, "package.json"), "utf8"));
+const version = kayraVersion(typeof manifest === "object" && manifest !== null && "version" in manifest ? manifest.version : undefined);
+if (!version.ok)
+    throw new Error(`kayra's package.json: ${version.error}`);
+const onServer = (on, target, command) => {
+    switch (command.name) {
+        case "up":
+            return server.up(on, target);
+        case "provision":
+            return server.provision(on, target);
+        case "deploy":
+            return server.deploy(on, target);
+        case "setup":
+            return server.setup(on, target);
+        case "apps":
+            return server.apps(on, target);
+        case "hosts":
+            return server.hosts(on, target);
+        case "ssh":
+            return server.ssh(target);
+        case "down":
+            return server.down(target);
+        case "adopt":
+            return server.adopt(on, target);
+        case "backup test":
+            return server.backupTest(on, target);
+    }
+};
+const plan = (fleet, command) => {
+    const on = { kayra, version: version.value, fleet: fleet.root };
+    if (command.name === "doctor")
+        return ok(doctor(fleet, kayra));
+    if (command.name === "certs")
+        return server.certsFor(on, command.domain, command.subdomains);
+    if (command.name === "app purge")
+        return flatMap(serverNamed(fleet, command.server), (target) => server.appPurge(on, target, command.app));
+    return flatMap(serverNamed(fleet, command.server), (target) => onServer(on, target, command));
+};
+const io = {
+    out: (line) => {
+        console.log(line);
+    },
+    err: (line) => {
+        console.error(line);
+    },
+    ask: async (prompt) => {
+        const terminal = createInterface({ input: process.stdin, output: process.stderr });
+        const answer = await terminal.question(prompt);
+        terminal.close();
+        return answer;
+    },
+};
+const fail = (message) => {
+    console.error(`kayra: ${message}`);
+    process.exit(1);
+};
+const fleet = flatMap(findFleetRoot(here.value), loadFleet);
+if (!fleet.ok)
+    fail(fleet.error);
+else {
+    const args = run(parser(fleet.value), { programName: "kayra", help: "both", completion: "both" });
+    if (args.command.name === "status") {
+        (await status(fleet.value)).forEach(io.out);
+    }
+    else {
+        const steps = plan(fleet.value, args.command);
+        if (!steps.ok)
+            fail(steps.error);
+        else if (args.dryRun)
+            render(steps.value).forEach(io.out);
+        // eslint-disable-next-line functional/immutable-data -- the exit status; process.exit() could cut piped output short
+        else
+            process.exitCode = (await interpret(steps.value, io)) ? 0 : 1;
+    }
+}

package/cli/dist/plan.js

@@ -0,0 +1,31 @@
+export const run = (argv, env = {}) => ({
+    kind: "run",
+    argv,
+    env,
+    stdout: "show",
+});
+const quote = (word) => (/^[\w@%+=:,./~-]+$/.test(word) ? word : `'${word.replaceAll("'", `'\\''`)}'`);
+export const shell = (argv) => argv.map(quote).join(" ");
+const assignments = (env = {}) => Object.entries(env)
+    .map(([key, value]) => `${key}=${quote(value)} `)
+    .join("");
+const arg = (value) => {
+    if (typeof value === "string")
+        return quote(value);
+    const command = `$(${assignments(value.env)}${shell(value.argv)})`;
+    return value.words === "one" ? `"${command}"` : command;
+};
+const describeProbe = (probe) => probe.kind === "on-path" ? `command -v ${quote(probe.program)}` : assignments(probe.env) + shell(probe.argv);
+const describe = (step) => {
+    switch (step.kind) {
+        case "run":
+            return `run      ${assignments(step.env)}${step.argv.map(arg).join(" ")}${step.stdout === "discard" ? " >/dev/null" : ""}`;
+        case "check":
+            return `${step.onFailure === "stop" ? "guard   " : "check   "} ${step.label}: ${describeProbe(step.probe)}`;
+        case "confirm":
+            return `confirm  ${step.prompt}(${step.expect})`;
+        case "note":
+            return `note     ${step.text}`;
+    }
+};
+export const render = (plan) => plan.map(describe);

package/cli/dist/result.js

@@ -0,0 +1,5 @@
+export const ok = (value) => ({ ok: true, value });
+export const err = (error) => ({ ok: false, error });
+export const map = (result, f) => result.ok ? ok(f(result.value)) : result;
+export const flatMap = (result, f) => (result.ok ? f(result.value) : result);
+export const all = (results) => results.reduce((acc, result) => flatMap(acc, (values) => map(result, (value) => [...values, value])), ok([]));