blogwright 0.1.0

package/dist/adapters/fetch-ping.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Fetch adapter for the PingBuilder port: opens a connection to the builder
+ * MicroVM's proxy endpoint to wake the resumed agent's event loop. Errors never
+ * cross the port — the ping is best-effort by contract, and the agent's HTTP/1
+ * server may not even parse the request.
+ */
+import type { PingBuilder } from '../ports.js';
+/** Build the fetch-backed ping. `fetchImpl` is injectable for tests. */
+export declare function createFetchPing(fetchImpl?: typeof fetch): PingBuilder;

package/dist/adapters/fetch-ping.js

@@ -0,0 +1,26 @@
+/**
+ * Fetch adapter for the PingBuilder port: opens a connection to the builder
+ * MicroVM's proxy endpoint to wake the resumed agent's event loop. Errors never
+ * cross the port — the ping is best-effort by contract, and the agent's HTTP/1
+ * server may not even parse the request.
+ */
+/** A nudge only needs the connection to land; never hold a poll cycle longer than this. */
+const PING_TIMEOUT_MS = 2500;
+/** Build the fetch-backed ping. `fetchImpl` is injectable for tests. */
+export function createFetchPing(fetchImpl = fetch) {
+    return async (endpoint, token) => {
+        try {
+            const res = await fetchImpl(`https://${endpoint}/status`, {
+                headers: { 'X-aws-proxy-auth': token, 'X-aws-proxy-port': '8080' },
+                signal: AbortSignal.timeout(PING_TIMEOUT_MS),
+            });
+            // Release the connection — an unread body pins an undici socket per
+            // poll cycle until GC.
+            await res.body?.cancel();
+        }
+        catch {
+            /* expected — the point is the wake-up, not the response */
+        }
+    };
+}
+//# sourceMappingURL=fetch-ping.js.map

package/dist/adapters/fetch-ping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-ping.js","sourceRoot":"","sources":["../../src/adapters/fetch-ping.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,2FAA2F;AAC3F,MAAM,eAAe,GAAG,IAAI,CAAC;AAE7B,wEAAwE;AACxE,MAAM,UAAU,eAAe,CAAC,YAA0B,KAAK;IAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE;QAC/B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,WAAW,QAAQ,SAAS,EAAE;gBACxD,OAAO,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE;gBAClE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC;aAC7C,CAAC,CAAC;YACH,oEAAoE;YACpE,uBAAuB;YACvB,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,2DAA2D;QAC7D,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/adapters/process-vcs.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Process adapter for the Vcs port: shells out to jj/git. The only module
+ * outside the build-agent that may import node:child_process; failures are
+ * translated with the command and directory before they cross the port.
+ */
+import type { Vcs } from '../ports.js';
+/**
+ * Build the jj/git process adapter. The revision hash prefers jj's git commit
+ * id (jj auto-commits the working copy), falling back to git HEAD; listings
+ * honor .gitignore — tracked files plus untracked files that are not ignored.
+ */
+export declare function createProcessVcs(): Vcs;

package/dist/adapters/process-vcs.js

@@ -0,0 +1,49 @@
+/**
+ * Process adapter for the Vcs port: shells out to jj/git. The only module
+ * outside the build-agent that may import node:child_process; failures are
+ * translated with the command and directory before they cross the port.
+ */
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+const run = promisify(execFile);
+/** `git ls-files -z` output can exceed the 1 MiB default buffer on large repos. */
+const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+async function runVcsCommand(cwd, command, args) {
+    try {
+        const { stdout } = await run(command, args, { cwd, maxBuffer: MAX_OUTPUT_BYTES });
+        return stdout;
+    }
+    catch (err) {
+        throw new Error(`${command} ${args.join(' ')} failed in ${cwd}: ${err.message}`, {
+            cause: err,
+        });
+    }
+}
+/**
+ * Build the jj/git process adapter. The revision hash prefers jj's git commit
+ * id (jj auto-commits the working copy), falling back to git HEAD; listings
+ * honor .gitignore — tracked files plus untracked files that are not ignored.
+ */
+export function createProcessVcs() {
+    return {
+        async revisionHash(cwd) {
+            try {
+                const jjArgs = ['log', '--no-graph', '-r', '@', '-T', 'commit_id.short()'];
+                const hash = (await runVcsCommand(cwd, 'jj', jjArgs)).trim();
+                if (hash)
+                    return hash;
+            }
+            catch {
+                /* jj unavailable or not a jj repo — fall through to git */
+            }
+            return (await runVcsCommand(cwd, 'git', ['rev-parse', '--short', 'HEAD'])).trim();
+        },
+        async listFiles(cwd) {
+            // -z gives NUL-separated, un-quoted paths (correct for names with spaces/unicode).
+            const args = ['ls-files', '-z', '--cached', '--others', '--exclude-standard'];
+            const stdout = await runVcsCommand(cwd, 'git', args);
+            return stdout.split('\0').filter(Boolean);
+        },
+    };
+}
+//# sourceMappingURL=process-vcs.js.map

package/dist/adapters/process-vcs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-vcs.js","sourceRoot":"","sources":["../../src/adapters/process-vcs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAItC,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAEhC,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,IAAc;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,GAAG,KAAM,GAAa,CAAC,OAAO,EAAE,EAAE;YAC1F,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,GAAW;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBAC3E,MAAM,IAAI,GAAG,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC7D,IAAI,IAAI;oBAAE,OAAO,IAAI,CAAC;YACxB,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,OAAO,CAAC,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpF,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,GAAW;YACzB,mFAAmF;YACnF,MAAM,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,oBAAoB,CAAC,CAAC;YAC9E,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/agent-package.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Packages the build-agent artifacts (Dockerfile, bundled server.js,
+ * agent-manifest.json) into a reproducible zip and uploads it to S3. Reads the
+ * artifacts through the FileSystem port from the composition-root-resolved
+ * `ctx.agentDir`; this module touches no Node API directly.
+ */
+import type { OpsContext } from './context.js';
+/**
+ * Package the build-agent (Dockerfile + bundled server) into a zip and upload it to
+ * `build/agent/agent-<hash>.zip`. `<hash>` is the reproducible source hash stamped
+ * into agent-manifest.json when the agent was bundled — a hash of the agent's
+ * *source*, not the bundle, because bundle bytes vary by build platform/toolchain
+ * while source bytes are identical everywhere. The MicroVM image is then built from
+ * this artifact and keyed by the same hash, so identical source never rebuilds.
+ */
+export declare function packageAndUploadAgent(ctx: OpsContext): Promise<{
+    key: string;
+    hash: string;
+}>;

package/dist/agent-package.js

@@ -0,0 +1,49 @@
+/**
+ * Packages the build-agent artifacts (Dockerfile, bundled server.js,
+ * agent-manifest.json) into a reproducible zip and uploads it to S3. Reads the
+ * artifacts through the FileSystem port from the composition-root-resolved
+ * `ctx.agentDir`; this module touches no Node API directly.
+ */
+import { zipSync } from 'fflate';
+const IMAGE_PACKAGE_JSON = JSON.stringify({
+    name: 'site-builder',
+    private: true,
+    type: 'module',
+});
+/**
+ * Package the build-agent (Dockerfile + bundled server) into a zip and upload it to
+ * `build/agent/agent-<hash>.zip`. `<hash>` is the reproducible source hash stamped
+ * into agent-manifest.json when the agent was bundled — a hash of the agent's
+ * *source*, not the bundle, because bundle bytes vary by build platform/toolchain
+ * while source bytes are identical everywhere. The MicroVM image is then built from
+ * this artifact and keyed by the same hash, so identical source never rebuilds.
+ */
+export async function packageAndUploadAgent(ctx) {
+    const dir = ctx.agentDir;
+    const { fs } = ctx.ports;
+    let dockerfile;
+    let server;
+    let manifest;
+    try {
+        dockerfile = await fs.readBytes(`${dir}/Dockerfile`);
+        server = await fs.readBytes(`${dir}/server.js`);
+        manifest = JSON.parse(await fs.readText(`${dir}/agent-manifest.json`));
+    }
+    catch {
+        throw new Error(`build-agent artifacts not found in ${dir}. Run "pnpm --filter blogwright build" first.`);
+    }
+    const hash = manifest.hash;
+    if (!hash || !/^[0-9a-f]{12}$/.test(hash)) {
+        throw new Error(`agent-manifest.json in ${dir} has no valid hash — rebuild the agent`);
+    }
+    const entries = {
+        Dockerfile: dockerfile,
+        'server.js': server,
+        'package.json': new TextEncoder().encode(IMAGE_PACKAGE_JSON),
+    };
+    const zip = zipSync(entries, { level: 6, mtime: new Date('1980-01-01T00:00:00Z') });
+    const key = `build/agent/agent-${hash}.zip`;
+    await ctx.clients.s3.putObject(ctx.names.bucket, key, zip, 'application/zip');
+    return { key, hash };
+}
+//# sourceMappingURL=agent-package.js.map

package/dist/agent-package.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-package.js","sourceRoot":"","sources":["../src/agent-package.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAIhD,MAAM,kBAAkB,GAAG,IAAI,CAAC,SAAS,CAAC;IACxC,IAAI,EAAE,cAAc;IACpB,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,QAAQ;CACf,CAAC,CAAC;AAEH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,GAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,IAAI,UAAsB,CAAC;IAC3B,IAAI,MAAkB,CAAC;IACvB,IAAI,QAA2B,CAAC;IAChC,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,GAAG,aAAa,CAAC,CAAC;QACrD,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC;QAChD,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,GAAG,GAAG,sBAAsB,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,sCAAsC,GAAG,+CAA+C,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,wCAAwC,CAAC,CAAC;IACzF,CAAC;IAED,MAAM,OAAO,GAAa;QACxB,UAAU,EAAE,UAAU;QACtB,WAAW,EAAE,MAAM;QACnB,cAAc,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC;KAC7D,CAAC;IACF,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IACpF,MAAM,GAAG,GAAG,qBAAqB,IAAI,MAAM,CAAC;IAE5C,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,iBAAiB,CAAC,CAAC;IAC9E,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC"}

package/dist/bin.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/bin.js

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+import { createNodeTerminal } from 'blogwright-core';
+import { main } from './cli.js';
+import { createLogger } from './logger.js';
+const makeTerminal = (opts) => createNodeTerminal(opts);
+main(process.argv.slice(2), makeTerminal)
+    .then((code) => {
+    process.exitCode = code;
+})
+    .catch((err) => {
+    createLogger(makeTerminal({ plain: true })).error(err instanceof Error ? err.message : String(err));
+    process.exitCode = 1;
+});
+//# sourceMappingURL=bin.js.map

package/dist/bin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bin.js","sourceRoot":"","sources":["../src/bin.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,YAAY,GAAG,CAAC,IAAwB,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAE5E,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC;KACtC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;IACb,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;AAC1B,CAAC,CAAC;KACD,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IACtB,YAAY,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAC/C,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CACjD,CAAC;IACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,6 @@
+import { type Terminal } from 'blogwright-core';
+/** Builds the Terminal after flag parsing, so --plain shapes the whole session. */
+export type TerminalFactory = (opts: {
+    plain: boolean;
+}) => Terminal;
+export declare function main(argv: string[], makeTerminal: TerminalFactory): Promise<number>;

package/dist/cli.js

@@ -0,0 +1,249 @@
+import { parseArgs } from 'node:util';
+import { createNodeFileSystem } from 'blogwright-core';
+import * as pds from 'blogwright-pds';
+import * as commands from './commands.js';
+import { createContext } from './context.js';
+import { initSite } from './init.js';
+import { createLogger } from './logger.js';
+const USAGE = `blogwright — full operations for a blog site on AWS (S3 + CloudFront, MicroVM builds)
+
+Usage:
+  blogwright <command> [env] [options]
+
+Commands:
+  init                        First-run wizard: writes config/production.jsonc
+  bootstrap   [env]           Create/reconcile the infrastructure graph
+  deploy      [env]           Zip the repo, build in a MicroVM, publish to site/
+  rollback    <hash> [env]    Re-deploy an existing build by hash
+  delete      [env]           Empty the live site/ prefix
+  destroy     [env] --yes     Tear down all infrastructure
+  history     [env]           List deployment history
+  logs        <hash> [env]    Show CloudWatch build logs for a hash
+  status      [env]           Show planned graph vs. live state
+
+  preview bootstrap           Provision the shared preview stack
+  preview deploy <id>         Build + publish a PR preview (id like pr-42)
+  preview destroy <id>        Remove one PR preview
+  preview list                List active previews
+  preview teardown --yes      Tear down the whole preview stack
+
+  pds keygen                  Generate the OAuth client key: private JWK into
+                              Secrets Manager, public documents into public/oauth/
+                              (commit + release those before pds login)
+  pds login --identifier <handle-or-did>
+                              Interactive OAuth bootstrap: prints an authorize URL,
+                              then expects the pasted /oauth/callback redirect URL;
+                              the session is stored in Secrets Manager and refreshed
+                              automatically on every sync
+  pds secret status           Show secret metadata (never the value)
+  pds secret delete --yes     Delete the secret (logs out and discards the key)
+  pds init                    Create/update the standard.site publication record and
+                              write the site verification files (commit them)
+  pds sync                    Reconcile site.standard.document records with the
+                              content collection (production only; also runs after
+                              every successful production deploy)
+
+Options:
+  --env <name>      Environment (default: production; also accepted positionally)
+  --domain <fqdn>   Custom domain (ACM cert + CloudFront alias)
+  --config <path>   Path to a JSONC config file
+  --endpoint <url>  AWS endpoint override (e.g. http://localhost:4566 for floci)
+  --id <preview>    Preview id for preview deploy/destroy (also accepted positionally)
+  --plain           Minimal machine-friendly output (no colour, no live status,
+                    no prompts) — for CI systems and agents; also automatic when
+                    output is piped. NO_COLOR disables colour only.
+  --yes             Confirm destructive operations
+  --help            Show this help
+`;
+const HASH_COMMANDS = new Set(['rollback', 'logs']);
+const KNOWN_COMMANDS = new Set([
+    'bootstrap',
+    'deploy',
+    'rollback',
+    'delete',
+    'destroy',
+    'history',
+    'logs',
+    'status',
+]);
+export async function main(argv, makeTerminal) {
+    const { values, positionals } = parseArgs({
+        args: argv,
+        allowPositionals: true,
+        options: {
+            env: { type: 'string' },
+            domain: { type: 'string' },
+            config: { type: 'string' },
+            endpoint: { type: 'string' },
+            hash: { type: 'string' },
+            id: { type: 'string' },
+            identifier: { type: 'string' },
+            plain: { type: 'boolean', default: false },
+            yes: { type: 'boolean', default: false },
+            help: { type: 'boolean', default: false },
+        },
+    });
+    const terminal = makeTerminal({ plain: values.plain });
+    const logger = createLogger(terminal);
+    const command = positionals[0];
+    if (!command || values.help) {
+        logger.info(USAGE);
+        // Asking for help is success; invoking with no command at all is not.
+        return values.help || command ? 0 : 1;
+    }
+    if (command === 'init') {
+        // Runs before any context exists — there is no config to load yet.
+        return initSite(createNodeFileSystem(), terminal, logger);
+    }
+    if (command === 'preview') {
+        return runPreview(positionals, values, terminal, logger);
+    }
+    if (command === 'pds') {
+        return runPds(positionals, values, terminal, logger);
+    }
+    if (!KNOWN_COMMANDS.has(command)) {
+        logger.error(`unknown command: ${command}`);
+        logger.info(USAGE);
+        return 1;
+    }
+    // Positional layout: rollback/logs take <hash> first, then optional env.
+    let hash;
+    let envPositional;
+    if (HASH_COMMANDS.has(command)) {
+        hash = values.hash ?? positionals[1];
+        envPositional = positionals[2];
+    }
+    else {
+        envPositional = positionals[1];
+    }
+    const env = values.env ?? envPositional ?? 'production';
+    const ctx = await createContext({
+        env,
+        configPath: values.config,
+        domain: values.domain,
+        endpointOverride: values.endpoint,
+        ports: { terminal },
+    });
+    switch (command) {
+        case 'bootstrap':
+            await commands.bootstrap(ctx);
+            break;
+        case 'deploy':
+            await commands.deploy(ctx);
+            break;
+        case 'rollback':
+            if (!hash)
+                throw new Error('rollback requires a <hash>');
+            await commands.rollback(ctx, hash);
+            break;
+        case 'delete':
+            await commands.deleteSite(ctx);
+            break;
+        case 'destroy':
+            await commands.destroy(ctx, { yes: values.yes });
+            break;
+        case 'history':
+            await commands.history(ctx);
+            break;
+        case 'logs':
+            if (!hash)
+                throw new Error('logs requires a <hash>');
+            await commands.logs(ctx, hash);
+            break;
+        case 'status':
+            await commands.status(ctx);
+            break;
+        default:
+            logger.error(`unknown command: ${command}`);
+            logger.info(USAGE);
+            return 1;
+    }
+    return 0;
+}
+/** Handle `blogwright pds <action> [env]` (and `pds secret <action> [env]`). */
+async function runPds(positionals, values, terminal, logger) {
+    // `pds secret set production` — the secret sub-action shifts positionals by one.
+    const secret = positionals[1] === 'secret';
+    const action = secret ? `secret ${positionals[2] ?? ''}`.trim() : positionals[1];
+    const envPositional = positionals[secret ? 3 : 2];
+    const known = new Set(['keygen', 'login', 'init', 'sync', 'secret status', 'secret delete']);
+    if (!action || !known.has(action)) {
+        logger.error(`unknown pds action: ${action ?? '(none)'}`);
+        logger.info(USAGE);
+        return 1;
+    }
+    const ctx = await createContext({
+        env: values.env ?? envPositional ?? 'production',
+        configPath: values.config,
+        domain: values.domain,
+        endpointOverride: values.endpoint,
+        ports: { terminal },
+    });
+    switch (action) {
+        case 'keygen':
+            await pds.keygen(ctx);
+            break;
+        case 'login':
+            await pds.login(ctx, { identifier: values.identifier });
+            break;
+        case 'secret status':
+            await pds.secretStatus(ctx);
+            break;
+        case 'secret delete':
+            await pds.secretDelete(ctx, { yes: values.yes });
+            break;
+        case 'init':
+            await pds.init(ctx);
+            break;
+        case 'sync':
+            await pds.sync(ctx);
+            break;
+    }
+    return 0;
+}
+/** Handle `blogwright preview <action> [id]` (always the shared `preview` stack). */
+const PREVIEW_ACTIONS = new Set(['bootstrap', 'deploy', 'destroy', 'list', 'teardown']);
+async function runPreview(positionals, values, terminal, logger) {
+    const action = positionals[1];
+    const id = values.id ?? positionals[2];
+    if (!action || !PREVIEW_ACTIONS.has(action)) {
+        logger.error(`unknown preview action: ${action ?? '(none)'}`);
+        logger.info(USAGE);
+        return 1;
+    }
+    const ctx = await createContext({
+        env: 'preview',
+        preview: true,
+        configPath: values.config,
+        domain: values.domain,
+        endpointOverride: values.endpoint,
+        ports: { terminal },
+    });
+    switch (action) {
+        case 'bootstrap':
+            await commands.previewBootstrap(ctx);
+            break;
+        case 'deploy':
+            if (!id)
+                throw new Error('preview deploy requires an <id> (e.g. pr-42)');
+            await commands.previewDeploy(ctx, id);
+            break;
+        case 'destroy':
+            if (!id)
+                throw new Error('preview destroy requires an <id>');
+            await commands.previewDestroy(ctx, id);
+            break;
+        case 'list':
+            await commands.previewList(ctx);
+            break;
+        case 'teardown':
+            await commands.previewTeardown(ctx, { yes: values.yes });
+            break;
+        default:
+            logger.error(`unknown preview action: ${action ?? '(none)'}`);
+            logger.info(USAGE);
+            return 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,oBAAoB,EAAiB,MAAM,iBAAiB,CAAC;AACtE,OAAO,KAAK,GAAG,MAAM,gBAAgB,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,YAAY,EAAe,MAAM,aAAa,CAAC;AAExD,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDb,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,WAAW;IACX,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,SAAS;IACT,SAAS;IACT,MAAM;IACN,QAAQ;CACT,CAAC,CAAC;AAKH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc,EAAE,YAA6B;IACtE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,SAAS,CAAC;QACxC,IAAI,EAAE,IAAI;QACV,gBAAgB,EAAE,IAAI;QACtB,OAAO,EAAE;YACP,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACvB,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC1B,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACxB,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACtB,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YAC1C,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;YACxC,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE;SAC1C;KACF,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IAEtC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,sEAAsE;QACtE,OAAO,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,mEAAmE;QACnE,OAAO,QAAQ,CAAC,oBAAoB,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,yEAAyE;IACzE,IAAI,IAAwB,CAAC;IAC7B,IAAI,aAAiC,CAAC;IACtC,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/B,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QACrC,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,aAAa,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,aAAa,IAAI,YAAY,CAAC;IAExD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;QAC9B,GAAG;QACH,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE;KACpB,CAAC,CAAC;IAEH,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,WAAW;YACd,MAAM,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC9B,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM;QACR,KAAK,UAAU;YACb,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;YACzD,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YACnC,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM;QACR,KAAK,SAAS;YACZ,MAAM,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM;QACR,KAAK,MAAM;YACT,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;YACrD,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC/B,MAAM;QACR,KAAK,QAAQ;YACX,MAAM,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC3B,MAAM;QACR;YACE,MAAM,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAWD,gFAAgF;AAChF,KAAK,UAAU,MAAM,CACnB,WAAqB,EACrB,MAAiB,EACjB,QAAkB,EAClB,MAAc;IAEd,iFAAiF;IACjF,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,UAAU,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,uBAAuB,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;QAC9B,GAAG,EAAE,MAAM,CAAC,GAAG,IAAI,aAAa,IAAI,YAAY;QAChD,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE;KACpB,CAAC,CAAC;IAEH,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,QAAQ;YACX,MAAM,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM;QACR,KAAK,OAAO;YACV,MAAM,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,eAAe;YAClB,MAAM,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM;QACR,KAAK,eAAe;YAClB,MAAM,GAAG,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM;QACR,KAAK,MAAM;YACT,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACpB,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAUD,qFAAqF;AACrF,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;AAExF,KAAK,UAAU,UAAU,CACvB,WAAqB,EACrB,MAAqB,EACrB,QAAkB,EAClB,MAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,MAAM,CAAC,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,aAAa,CAAC;QAC9B,GAAG,EAAE,SAAS;QACd,OAAO,EAAE,IAAI;QACb,UAAU,EAAE,MAAM,CAAC,MAAM;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,gBAAgB,EAAE,MAAM,CAAC,QAAQ;QACjC,KAAK,EAAE,EAAE,QAAQ,EAAE;KACpB,CAAC,CAAC;IAEH,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,WAAW;YACd,MAAM,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,QAAQ;YACX,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;YACzE,MAAM,QAAQ,CAAC,aAAa,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACtC,MAAM;QACR,KAAK,SAAS;YACZ,IAAI,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC7D,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACvC,MAAM;QACR,KAAK,MAAM;YACT,MAAM,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;YAChC,MAAM;QACR,KAAK,UAAU;YACb,MAAM,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACzD,MAAM;QACR;YACE,MAAM,CAAC,KAAK,CAAC,2BAA2B,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnB,OAAO,CAAC,CAAC;IACb,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1,31 @@
+import type { OpsContext } from './context.js';
+/** Create the full infrastructure graph. */
+export declare function bootstrap(ctx: OpsContext): Promise<void>;
+/** Destroy the full infrastructure graph. */
+export declare function destroy(ctx: OpsContext, opts: {
+    yes: boolean;
+}): Promise<void>;
+/** Zip the repo, upload it, run the builder MicroVM, and invalidate the cache. */
+export declare function deploy(ctx: OpsContext): Promise<void>;
+/** Re-run the builder against an existing source zip for the given hash. */
+export declare function rollback(ctx: OpsContext, hash: string): Promise<void>;
+/** Provision the shared preview stack (one CloudFront distribution + host router + OIDC role). */
+export declare function previewBootstrap(ctx: OpsContext): Promise<void>;
+/** Build the current repo and publish it to this PR's preview prefix. Prints the URL. */
+export declare function previewDeploy(ctx: OpsContext, id: string): Promise<string>;
+/** Remove one PR's preview (delete its prefix). No invalidation — previews aren't cached. */
+export declare function previewDestroy(ctx: OpsContext, id: string): Promise<void>;
+/** List active previews (by prefix). */
+export declare function previewList(ctx: OpsContext): Promise<void>;
+/** Tear down the entire shared preview stack. */
+export declare function previewTeardown(ctx: OpsContext, opts: {
+    yes: boolean;
+}): Promise<void>;
+/** Empty the live site/ prefix (leaves infra and build history intact). */
+export declare function deleteSite(ctx: OpsContext): Promise<void>;
+/** List deployment history from build manifests. */
+export declare function history(ctx: OpsContext): Promise<void>;
+/** Show CloudWatch build logs for a given hash. */
+export declare function logs(ctx: OpsContext, hash: string): Promise<void>;
+/** Show the planned graph against live state (drift view). */
+export declare function status(ctx: OpsContext): Promise<void>;