everything-dev 2.0.0-rc.6 → 2.0.0-rc.7

package/dist/commands/deploy.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.cjs","names":["Context","BosDepsTag","MISSING_CONFIG_MESSAGE","publishToFastKv","fetchConfigHistory","summarizeSlotPins","fetchBosConfigFromFastKv","verifyRollbackSnapshot","BosConfigSchema","buildRollbackPayload","fetchDeployManifests","process","isValidImageDigest","openResolution","resolveDeployImagePlan","resolveImageRef","hasDocker","existsSync","join","colors","icons","buildAndPushImage","deployImageToRailway"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA2BA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,SAAS,MAAMC,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADOH,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAME,kCAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAASC,mCAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAMC,wCAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAMC,wCAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAeC,8BAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAUC,sCAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAMN,gCAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADOH,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARaQ,oCAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAeC,qBAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAACC,wCAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAMT,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAMU,0CAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAYC,4CAAuB;IAKvC,UAAUC,qCAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAKJ,qBAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAMK,+BAAU;IAC3B,mBAAeC,wBAAWC,gBAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAIC,qBAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACNA,qBAAO,MACL,KAAKC,oBAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAMC,uCAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACNF,qBAAO,MACL,KAAKC,oBAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAEA,IAAIR,qBAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACNQ,qBAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAMG,0CAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAIH,qBAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAIA,qBAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"deploy.cjs","names":["fetchConfigHistory","verifyRollbackSnapshot","buildRollbackPayload","BosConfigSchema","publishToFastKv","Context","BosDepsTag","MISSING_CONFIG_MESSAGE","summarizeSlotPins","fetchBosConfigFromFastKv","fetchDeployManifests","process","isValidImageDigest","openResolution","resolveDeployImagePlan","resolveImageRef","hasDocker","existsSync","join","colors","icons","buildAndPushImage","runSmoke","imageRefWithDigest","deployImageToRailway"],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  imageRefWithDigest,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport { runSmoke } from \"../smoke\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\ninterface RollbackToPreviousInput {\n  account: string;\n  domain: string;\n  env: \"production\" | \"staging\";\n  runtimeConfig: Parameters<typeof publishToFastKv>[0][\"runtimeConfig\"];\n  configDir: string;\n  registry?: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  wallet?: boolean;\n  verbose?: boolean;\n}\n\n/** Roll the registry config back to the previous snapshot in the FastKV\n * publish history — the post-publish smoke failure protocol (ADR 0021):\n * a red boot gate must never leave a new config live against an old image,\n * so the promotion is halted and the config reverts to the last known-good\n * snapshot within seconds. */\nasync function rollbackToPreviousSnapshot(\n  input: RollbackToPreviousInput,\n): Promise<{ ok: boolean; blockHeight?: string; error?: string }> {\n  let history: ConfigHistoryEntry[];\n  try {\n    history = await fetchConfigHistory({\n      accountId: input.account,\n      gatewayId: input.domain,\n      registry: input.registry,\n      limit: 20,\n    });\n  } catch (error) {\n    return {\n      ok: false,\n      error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n\n  const previous = history[1];\n  if (!previous) {\n    return {\n      ok: false,\n      error: \"no previous snapshot in the publish history — nothing to roll back to\",\n    };\n  }\n\n  const verification = await verifyRollbackSnapshot(previous.value as BosConfigInput);\n  if (!verification.ok && verification.verifiable) {\n    return {\n      ok: false,\n      error: \"rollback refused — a pinned slot's bytes are gone or no longer match their SRI\",\n    };\n  }\n\n  const payload = buildRollbackPayload(\n    BosConfigSchema.parse(previous.value),\n    new Date().toISOString(),\n  );\n  const result = await publishToFastKv({\n    bosConfig: payload,\n    runtimeConfig: input.runtimeConfig,\n    configDir: input.configDir,\n    env: input.env,\n    build: false,\n    dryRun: false,\n    verbose: input.verbose,\n    packages: \"all\",\n    network: input.network,\n    privateKey: input.privateKey,\n    wallet: input.wallet,\n    registry: input.registry,\n    exactPayload: true,\n  });\n  if (result.status !== \"published\") {\n    return {\n      ok: false,\n      error: `rollback publish failed: ${result.error ?? result.status}`,\n    };\n  }\n  return { ok: true, blockHeight: String(previous.blockHeight) };\n}\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n        exactPayload: true,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      // Post-publish boot gate (publish → smoke → Railway, ADR 0021): the\n      // just-published config is only promoted to Railway if the runtime\n      // image — the one this train pinned — boots against it. A red smoke\n      // rolls the config back to the previous snapshot, so the new-config/\n      // old-image window never survives the deploy run.\n      if (input.smoke) {\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)\",\n            ),\n          );\n        } else {\n          console.log();\n          console.log(colors.cyan(\"  ▶ Post-publish smoke (boot gate)\"));\n          const smokeResult = await runSmoke({\n            image: imageRefWithDigest(image, imageDigest),\n            account: nextSession.config?.account,\n            gateway: nextSession.config?.domain,\n          });\n          if (!smokeResult.ok) {\n            const cause = smokeResult.error ?? \"unknown failure\";\n            console.log();\n            console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));\n            if (smokeResult.diagnosis) {\n              console.log(colors.yellow(`  ${smokeResult.diagnosis}`));\n            }\n            const account = nextSession.config?.account;\n            const domain = nextSession.config?.domain;\n            if (!account || !domain) {\n              console.log(colors.yellow(\"  Rollback skipped: no registry identity in the session\"));\n              return {\n                status: \"published\" as const,\n                ...configPublished,\n                image,\n                error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`,\n              };\n            }\n            console.log(colors.yellow(\"  Rolling the published config back…\"));\n            const rollback = await rollbackToPreviousSnapshot({\n              account,\n              domain,\n              env: input.env,\n              runtimeConfig: nextSession.runtime,\n              configDir: nextSession.root,\n              registry: input.registry,\n              network: input.network,\n              privateKey: input.privateKey,\n              wallet: input.wallet,\n              verbose: input.verbose,\n            });\n            const rollbackNote = rollback.ok\n              ? `config rolled back to block ${rollback.blockHeight}`\n              : `config NOT rolled back: ${rollback.error ?? \"unknown\"}`;\n            console.log(colors.yellow(`  ${rollbackNote}`));\n            return {\n              status: \"published\" as const,\n              ...configPublished,\n              image,\n              error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`,\n            };\n          }\n          console.log(\n            colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? \"\"}`),\n          );\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AA+CA,eAAe,2BACb,OACgE;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,MAAMA,kCAAmB;GACjC,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,OAAO;EACT,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GACL,IAAI;GACJ,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAClG;CACF;CAEA,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,UACH,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,eAAe,MAAMC,wCAAuB,SAAS,KAAuB;CAClF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,UAAUC,sCACdC,8BAAgB,MAAM,SAAS,KAAK,oBACpC,IAAI,KAAK,EAAC,CAAC,YAAY,CACzB;CACA,MAAM,SAAS,MAAMC,gCAAgB;EACnC,WAAW;EACX,eAAe,MAAM;EACrB,WAAW,MAAM;EACjB,KAAK,MAAM;EACX,OAAO;EACP,QAAQ;EACR,SAAS,MAAM;EACf,UAAU;EACV,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,cAAc;CAChB,CAAC;CACD,IAAI,OAAO,WAAW,aACpB,OAAO;EACL,IAAI;EACJ,OAAO,4BAA4B,OAAO,SAAS,OAAO;CAC5D;CAEF,OAAO;EAAE,IAAI;EAAM,aAAa,OAAO,SAAS,WAAW;CAAE;AAC/D;AAEA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,SAAS,MAAMH,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAMP,kCAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAASQ,mCAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAMC,wCAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAMR,wCAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAeE,8BAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAUD,sCAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAME,gCAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,cAAc;GAChB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADOC,eAAQ,IAAI,QAAQ,mBAAmBC,yBACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAOC;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARaG,oCAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAeC,qBAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAACC,wCAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAMR,gCAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAMS,0CAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAYC,4CAAuB;IAKvC,UAAUC,qCAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAKJ,qBAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAMK,+BAAU;IAC3B,mBAAeC,wBAAWC,gBAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAIC,qBAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACNA,qBAAO,MACL,KAAKC,oBAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAMC,uCAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACNF,qBAAO,MACL,KAAKC,oBAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAOA,IAAI,MAAM,OAAO;IACf,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,iGACF,CACF;IACF,OAAO;KACL,QAAQ,IAAI;KACZ,QAAQ,IAAIA,qBAAO,KAAK,oCAAoC,CAAC;KAC7D,MAAM,cAAc,MAAMG,uBAAS;MACjC,OAAOC,wCAAmB,OAAO,WAAW;MAC5C,SAAS,YAAY,QAAQ;MAC7B,SAAS,YAAY,QAAQ;KAC/B,CAAC;KACD,IAAI,CAAC,YAAY,IAAI;MACnB,MAAM,QAAQ,YAAY,SAAS;MACnC,QAAQ,IAAI;MACZ,QAAQ,IAAIJ,qBAAO,MAAM,KAAKC,oBAAM,IAAI,8BAA8B,OAAO,CAAC;MAC9E,IAAI,YAAY,WACd,QAAQ,IAAID,qBAAO,OAAO,KAAK,YAAY,WAAW,CAAC;MAEzD,MAAM,UAAU,YAAY,QAAQ;MACpC,MAAM,SAAS,YAAY,QAAQ;MACnC,IAAI,CAAC,WAAW,CAAC,QAAQ;OACvB,QAAQ,IAAIA,qBAAO,OAAO,yDAAyD,CAAC;OACpF,OAAO;QACL,QAAQ;QACR,GAAG;QACH;QACA,OAAO,8BAA8B,MAAM;OAC7C;MACF;MACA,QAAQ,IAAIA,qBAAO,OAAO,sCAAsC,CAAC;MACjE,MAAM,WAAW,MAAM,2BAA2B;OAChD;OACA;OACA,KAAK,MAAM;OACX,eAAe,YAAY;OAC3B,WAAW,YAAY;OACvB,UAAU,MAAM;OAChB,SAAS,MAAM;OACf,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;MACjB,CAAC;MACD,MAAM,eAAe,SAAS,KAC1B,+BAA+B,SAAS,gBACxC,2BAA2B,SAAS,SAAS;MACjD,QAAQ,IAAIA,qBAAO,OAAO,KAAK,cAAc,CAAC;MAC9C,OAAO;OACL,QAAQ;OACR,GAAG;OACH;OACA,OAAO,8BAA8B,MAAM,MAAM;MACnD;KACF;KACA,QAAQ,IACNA,qBAAO,MAAM,KAAKC,oBAAM,GAAG,8BAA8B,YAAY,WAAW,IAAI,CACtF;IACF;GACF;GAEA,IAAIT,qBAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACNQ,qBAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACNA,qBAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAMK,0CAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAIL,qBAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAIA,qBAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}

package/dist/commands/deploy.mjs

@@ -2,17 +2,73 @@ import { BosConfigSchema } from "../types.mjs";
 import { fetchBosConfigFromFastKv, fetchConfigHistory, fetchDeployManifests } from "../fastkv.mjs";
 import { MISSING_CONFIG_MESSAGE } from "../config.mjs";
 import { colors, icons } from "../utils/theme.mjs";
-import { buildAndPushImage, deployImageToRailway, hasDocker, isValidImageDigest, resolveDeployImagePlan, resolveImageRef } from "../image-deploy.mjs";
+import { buildAndPushImage, deployImageToRailway, hasDocker, imageRefWithDigest, isValidImageDigest, resolveDeployImagePlan, resolveImageRef } from "../image-deploy.mjs";
 import { openResolution } from "../resolution/session.mjs";
 import { BosDepsTag } from "./shared.mjs";
 import { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from "../rollback.mjs";
 import { publishToFastKv } from "../publish.mjs";
+import { runSmoke } from "../smoke.mjs";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 import { Context } from "effect";
 import process from "node:process";
 
 //#region src/commands/deploy.ts
+/** Roll the registry config back to the previous snapshot in the FastKV
+* publish history — the post-publish smoke failure protocol (ADR 0021):
+* a red boot gate must never leave a new config live against an old image,
+* so the promotion is halted and the config reverts to the last known-good
+* snapshot within seconds. */
+async function rollbackToPreviousSnapshot(input) {
+	let history;
+	try {
+		history = await fetchConfigHistory({
+			accountId: input.account,
+			gatewayId: input.domain,
+			registry: input.registry,
+			limit: 20
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`
+		};
+	}
+	const previous = history[1];
+	if (!previous) return {
+		ok: false,
+		error: "no previous snapshot in the publish history — nothing to roll back to"
+	};
+	const verification = await verifyRollbackSnapshot(previous.value);
+	if (!verification.ok && verification.verifiable) return {
+		ok: false,
+		error: "rollback refused — a pinned slot's bytes are gone or no longer match their SRI"
+	};
+	const payload = buildRollbackPayload(BosConfigSchema.parse(previous.value), (/* @__PURE__ */ new Date()).toISOString());
+	const result = await publishToFastKv({
+		bosConfig: payload,
+		runtimeConfig: input.runtimeConfig,
+		configDir: input.configDir,
+		env: input.env,
+		build: false,
+		dryRun: false,
+		verbose: input.verbose,
+		packages: "all",
+		network: input.network,
+		privateKey: input.privateKey,
+		wallet: input.wallet,
+		registry: input.registry,
+		exactPayload: true
+	});
+	if (result.status !== "published") return {
+		ok: false,
+		error: `rollback publish failed: ${result.error ?? result.status}`
+	};
+	return {
+		ok: true,
+		blockHeight: String(previous.blockHeight)
+	};
+}
 function registerDeploy(builder) {
 	return {
 		publish: builder.publish.handler(async ({ input, context }) => {
@@ -142,7 +198,8 @@ function registerDeploy(builder) {
 				network: input.network,
 				privateKey: input.privateKey,
 				wallet: input.wallet,
-				registry: input.registry
+				registry: input.registry,
+				exactPayload: true
 			});
 			return {
 				status: result.status,
@@ -282,6 +339,59 @@ function registerDeploy(builder) {
 					};
 				}
 			}
+			if (input.smoke) {
+				if (!image || !imageDigest) {
+					console.log();
+					console.log(colors.yellow("  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)"));
+				} else {
+					console.log();
+					console.log(colors.cyan("  ▶ Post-publish smoke (boot gate)"));
+					const smokeResult = await runSmoke({
+						image: imageRefWithDigest(image, imageDigest),
+						account: nextSession.config?.account,
+						gateway: nextSession.config?.domain
+					});
+					if (!smokeResult.ok) {
+						const cause = smokeResult.error ?? "unknown failure";
+						console.log();
+						console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));
+						if (smokeResult.diagnosis) console.log(colors.yellow(`  ${smokeResult.diagnosis}`));
+						const account = nextSession.config?.account;
+						const domain = nextSession.config?.domain;
+						if (!account || !domain) {
+							console.log(colors.yellow("  Rollback skipped: no registry identity in the session"));
+							return {
+								status: "published",
+								...configPublished,
+								image,
+								error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`
+							};
+						}
+						console.log(colors.yellow("  Rolling the published config back…"));
+						const rollback = await rollbackToPreviousSnapshot({
+							account,
+							domain,
+							env: input.env,
+							runtimeConfig: nextSession.runtime,
+							configDir: nextSession.root,
+							registry: input.registry,
+							network: input.network,
+							privateKey: input.privateKey,
+							wallet: input.wallet,
+							verbose: input.verbose
+						});
+						const rollbackNote = rollback.ok ? `config rolled back to block ${rollback.blockHeight}` : `config NOT rolled back: ${rollback.error ?? "unknown"}`;
+						console.log(colors.yellow(`  ${rollbackNote}`));
+						return {
+							status: "published",
+							...configPublished,
+							image,
+							error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`
+						};
+					}
+					console.log(colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? ""}`));
+				}
+			}
 			if (process.env.RAILWAY_TOKEN) {
 				const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;
 				if (!railwayService) {

package/dist/commands/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;AA2BA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,mBAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAAS,kBAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,yBAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAM,uBAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAe,gBAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAU,qBAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARa,qBAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAe,QAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAAC,mBAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAM,eAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAY,uBAAuB;IAKvC,UAAU,gBAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAK,QAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAM,UAAU;IAC3B,eAAe,WAAW,KAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAM,kBAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAEA,IAAI,QAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAM,qBAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAI,OAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/commands/deploy.ts"],"sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport process from \"node:process\";\nimport { Context } from \"effect\";\nimport { MISSING_CONFIG_MESSAGE } from \"../config\";\nimport {\n  type ConfigHistoryEntry,\n  fetchBosConfigFromFastKv,\n  fetchConfigHistory,\n  fetchDeployManifests,\n} from \"../fastkv\";\nimport {\n  buildAndPushImage,\n  deployImageToRailway,\n  hasDocker,\n  imageRefWithDigest,\n  isValidImageDigest,\n  resolveDeployImagePlan,\n  resolveImageRef,\n} from \"../image-deploy\";\nimport { publishToFastKv } from \"../publish\";\nimport { openResolution } from \"../resolution/session\";\nimport { buildRollbackPayload, summarizeSlotPins, verifyRollbackSnapshot } from \"../rollback\";\nimport { runSmoke } from \"../smoke\";\nimport type { BosConfigInput } from \"../types\";\nimport { BosConfigSchema } from \"../types\";\nimport { colors, icons } from \"../utils/theme\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\ninterface RollbackToPreviousInput {\n  account: string;\n  domain: string;\n  env: \"production\" | \"staging\";\n  runtimeConfig: Parameters<typeof publishToFastKv>[0][\"runtimeConfig\"];\n  configDir: string;\n  registry?: string;\n  network?: \"mainnet\" | \"testnet\";\n  privateKey?: string;\n  wallet?: boolean;\n  verbose?: boolean;\n}\n\n/** Roll the registry config back to the previous snapshot in the FastKV\n * publish history — the post-publish smoke failure protocol (ADR 0021):\n * a red boot gate must never leave a new config live against an old image,\n * so the promotion is halted and the config reverts to the last known-good\n * snapshot within seconds. */\nasync function rollbackToPreviousSnapshot(\n  input: RollbackToPreviousInput,\n): Promise<{ ok: boolean; blockHeight?: string; error?: string }> {\n  let history: ConfigHistoryEntry[];\n  try {\n    history = await fetchConfigHistory({\n      accountId: input.account,\n      gatewayId: input.domain,\n      registry: input.registry,\n      limit: 20,\n    });\n  } catch (error) {\n    return {\n      ok: false,\n      error: `fetching publish history failed: ${error instanceof Error ? error.message : String(error)}`,\n    };\n  }\n\n  const previous = history[1];\n  if (!previous) {\n    return {\n      ok: false,\n      error: \"no previous snapshot in the publish history — nothing to roll back to\",\n    };\n  }\n\n  const verification = await verifyRollbackSnapshot(previous.value as BosConfigInput);\n  if (!verification.ok && verification.verifiable) {\n    return {\n      ok: false,\n      error: \"rollback refused — a pinned slot's bytes are gone or no longer match their SRI\",\n    };\n  }\n\n  const payload = buildRollbackPayload(\n    BosConfigSchema.parse(previous.value),\n    new Date().toISOString(),\n  );\n  const result = await publishToFastKv({\n    bosConfig: payload,\n    runtimeConfig: input.runtimeConfig,\n    configDir: input.configDir,\n    env: input.env,\n    build: false,\n    dryRun: false,\n    verbose: input.verbose,\n    packages: \"all\",\n    network: input.network,\n    privateKey: input.privateKey,\n    wallet: input.wallet,\n    registry: input.registry,\n    exactPayload: true,\n  });\n  if (result.status !== \"published\") {\n    return {\n      ok: false,\n      error: `rollback publish failed: ${result.error ?? result.status}`,\n    };\n  }\n  return { ok: true, blockHeight: String(previous.blockHeight) };\n}\n\nexport function registerDeploy(builder: BosBuilder) {\n  return {\n    publish: builder.publish.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      };\n    }),\n\n    rollback: builder.rollback.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      const { account, domain } = session.config ?? {};\n      if (!account || !domain) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"authored config must define account and domain to roll back\",\n        };\n      }\n\n      let history: ConfigHistoryEntry[];\n      try {\n        history = await fetchConfigHistory({\n          accountId: account,\n          gatewayId: domain,\n          registry: input.registry,\n          limit: input.limit,\n        });\n      } catch (error) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Failed to fetch publish history: ${error instanceof Error ? error.message : String(error)}`,\n        };\n      }\n\n      if (history.length === 0) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `No publish history for ${account}/${domain} — nothing to roll back to`,\n        };\n      }\n\n      const historyEntries = history.map((entry) => ({\n        blockHeight: entry.blockHeight,\n        blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n        ...(entry.txHash ? { txHash: entry.txHash } : {}),\n        summary: summarizeSlotPins(entry.value as BosConfigInput),\n      }));\n\n      if (input.listOnly) {\n        return {\n          status: \"list\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n        };\n      }\n\n      const target =\n        input.version !== undefined\n          ? history.find((entry) => {\n              const iso = new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString();\n              return (\n                String(entry.blockHeight) === input.version ||\n                iso.startsWith(input.version as string)\n              );\n            })\n          : input.previous\n            ? history[1]\n            : undefined;\n\n      if (!target) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          history: historyEntries,\n          error: input.version\n            ? `No history entry matches \"${input.version}\" — pick a block height from the listing`\n            : \"Specify --version <block-height> or --previous (interactive selection happens CLI-side)\",\n        };\n      }\n\n      let liveValue: unknown;\n      try {\n        liveValue = await fetchBosConfigFromFastKv<unknown>(\n          `bos://${account}/${domain}`,\n          input.registry,\n        );\n      } catch {\n        liveValue = undefined;\n      }\n      if (liveValue && JSON.stringify(liveValue) === JSON.stringify(target.value)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: \"The selected snapshot is identical to the live config — nothing to do\",\n        };\n      }\n\n      const verification = await verifyRollbackSnapshot(target.value as BosConfigInput);\n      const slotChecks = verification.slots.map((check) => ({\n        slot: check.slot,\n        ok: check.ok,\n        ...(check.reason ? { reason: check.reason } : {}),\n      }));\n      if (!verification.ok && verification.verifiable) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          verification: slotChecks,\n          error:\n            \"Refusing to roll back — a pinned slot's bytes are gone or no longer match their SRI\",\n        };\n      }\n\n      if (!verification.verifiable && !input.force) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error:\n            \"Snapshot predates version manifests and cannot be verified — its bytes were overwritten in place. Re-run with --force to publish it anyway.\",\n        };\n      }\n\n      const parsedTarget = BosConfigSchema.parse(target.value);\n      const payload = buildRollbackPayload(parsedTarget, new Date().toISOString());\n\n      const result = await publishToFastKv({\n        bosConfig: payload,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: false,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: \"all\",\n        network: input.network,\n        privateKey: input.privateKey,\n        wallet: input.wallet,\n        registry: input.registry,\n        exactPayload: true,\n      });\n\n      return {\n        status: result.status,\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        error: result.error,\n        history: historyEntries,\n        ...(slotChecks.length > 0 ? { verification: slotChecks } : {}),\n      };\n    }),\n\n    deploy: builder.deploy.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const session = deps.session;\n      if (!session?.config) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: MISSING_CONFIG_MESSAGE,\n        };\n      }\n\n      if (input.statusList) {\n        if (!session.config?.account || !session.config.domain) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: \"authored config must define account and domain to list deploy manifests\",\n          };\n        }\n        try {\n          const manifests = await fetchDeployManifests({\n            accountId: session.config.account,\n            gatewayId: session.config.domain,\n            registry: input.registry,\n          });\n          return {\n            status: \"list\" as const,\n            registryUrl: \"\",\n            history: manifests.map((entry) => ({\n              key: entry.key,\n              blockHeight: entry.blockHeight,\n              blockTimestamp: new Date(Number(entry.blockTimestampNs.slice(0, 13))).toISOString(),\n              ...((entry.value as { txHash?: string } | undefined)?.txHash\n                ? { txHash: (entry.value as { txHash?: string }).txHash }\n                : {}),\n              ...((entry.value as { publishedAt?: string } | undefined)?.publishedAt\n                ? { publishedAt: (entry.value as { publishedAt?: string }).publishedAt }\n                : {}),\n            })),\n          };\n        } catch (error) {\n          return {\n            status: \"error\" as const,\n            registryUrl: \"\",\n            error: `Failed to list deploy manifests: ${error instanceof Error ? error.message : String(error)}`,\n          };\n        }\n      }\n\n      const imageDigestInput = input.imageDigest ?? process.env.BOS_IMAGE_DIGEST;\n      if (imageDigestInput && !isValidImageDigest(imageDigestInput)) {\n        return {\n          status: \"error\" as const,\n          registryUrl: \"\",\n          error: `Invalid image digest \"${imageDigestInput}\" — expected sha256:<64 hex characters> (--image-digest / BOS_IMAGE_DIGEST)`,\n        };\n      }\n\n      const result = await publishToFastKv({\n        bosConfig: session.config,\n        runtimeConfig: session.runtime,\n        configDir: session.root,\n        env: input.env,\n        build: input.build,\n        dryRun: input.dryRun,\n        verbose: input.verbose,\n        packages: input.packages,\n        network: input.network,\n        privateKey: input.privateKey,\n        registry: input.registry,\n        fullUpload: input.fullUpload,\n      });\n\n      if (result.status === \"error\") {\n        return {\n          status: \"error\" as const,\n          registryUrl: result.registryUrl,\n          txHash: result.txHash,\n          built: result.built,\n          skipped: result.skipped,\n          error: result.error,\n          deployResults: result.deployResults,\n        };\n      }\n\n      if (result.status === \"dry-run\") {\n        return {\n          status: \"dry-run\" as const,\n          registryUrl: result.registryUrl,\n          built: result.built,\n          skipped: result.skipped,\n        };\n      }\n\n      let nextSession = session;\n      if (result.publishConfig) {\n        const opened = await openResolution({ cwd: session.root });\n        if (opened) {\n          nextSession = opened;\n        }\n      }\n\n      const configPublished = {\n        registryUrl: result.registryUrl,\n        txHash: result.txHash,\n        fingerprint: result.fingerprint,\n        slotPins: result.slotPins,\n        built: result.built,\n        skipped: result.skipped,\n        deployResults: result.deployResults,\n      } as const;\n\n      let image: string | undefined;\n      let imageDigest: string | undefined;\n      let service: string | undefined;\n\n      const imagePlan = resolveDeployImagePlan({\n        // A prebuilt digest pairs with the pushed ref (BOS_IMAGE from the CI\n        // image job, or repository derivation) — ci.image is a build-time\n        // choice, not a pin-time one; letting it win here could pin a digest\n        // from a different image.\n        imageRef: resolveImageRef({\n          ciImage: imageDigestInput ? undefined : nextSession.config?.ci?.image,\n          repository: nextSession.config?.repository,\n          env: process.env,\n        }),\n        imageDigest: imageDigestInput,\n        hasDocker: await hasDocker(),\n        hasDockerfile: existsSync(join(session.root, \"Dockerfile\")),\n      });\n\n      if (imagePlan.kind === \"skip\") {\n        console.log();\n        console.log(colors.yellow(`  Image skipped: ${imagePlan.reason}`));\n      } else if (imagePlan.kind === \"prebuilt\") {\n        image = imagePlan.image;\n        imageDigest = imagePlan.digest;\n        console.log();\n        console.log(\n          colors.green(\n            `  ${icons.ok} Using pre-pushed image ${imagePlan.image}@${imagePlan.digest.slice(0, 19)}…`,\n          ),\n        );\n      } else {\n        console.log();\n        try {\n          const imageResult = await buildAndPushImage({\n            image: imagePlan.image,\n            configDir: session.root,\n            verbose: input.verbose,\n          });\n          image = imageResult.image;\n          imageDigest = imageResult.digest;\n          console.log(\n            colors.green(\n              `  ${icons.ok} Image pushed ${imageResult.image}:${imageResult.tag}${imageResult.digest ? ` (${imageResult.digest.slice(0, 19)}…)` : \"\"}`,\n            ),\n          );\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const imageError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Docker not found — install Docker to build the runtime image\"\n              : `Image build/push failed: ${message}`;\n          console.log(colors.yellow(`  ${imageError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            error: `Config published but ${imageError}`,\n          };\n        }\n      }\n\n      // Post-publish boot gate (publish → smoke → Railway, ADR 0021): the\n      // just-published config is only promoted to Railway if the runtime\n      // image — the one this train pinned — boots against it. A red smoke\n      // rolls the config back to the previous snapshot, so the new-config/\n      // old-image window never survives the deploy run.\n      if (input.smoke) {\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Post-publish smoke skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST)\",\n            ),\n          );\n        } else {\n          console.log();\n          console.log(colors.cyan(\"  ▶ Post-publish smoke (boot gate)\"));\n          const smokeResult = await runSmoke({\n            image: imageRefWithDigest(image, imageDigest),\n            account: nextSession.config?.account,\n            gateway: nextSession.config?.domain,\n          });\n          if (!smokeResult.ok) {\n            const cause = smokeResult.error ?? \"unknown failure\";\n            console.log();\n            console.log(colors.error(`  ${icons.err} Post-publish smoke failed: ${cause}`));\n            if (smokeResult.diagnosis) {\n              console.log(colors.yellow(`  ${smokeResult.diagnosis}`));\n            }\n            const account = nextSession.config?.account;\n            const domain = nextSession.config?.domain;\n            if (!account || !domain) {\n              console.log(colors.yellow(\"  Rollback skipped: no registry identity in the session\"));\n              return {\n                status: \"published\" as const,\n                ...configPublished,\n                image,\n                error: `Post-publish smoke failed (${cause}) — config NOT rolled back: no registry identity`,\n              };\n            }\n            console.log(colors.yellow(\"  Rolling the published config back…\"));\n            const rollback = await rollbackToPreviousSnapshot({\n              account,\n              domain,\n              env: input.env,\n              runtimeConfig: nextSession.runtime,\n              configDir: nextSession.root,\n              registry: input.registry,\n              network: input.network,\n              privateKey: input.privateKey,\n              wallet: input.wallet,\n              verbose: input.verbose,\n            });\n            const rollbackNote = rollback.ok\n              ? `config rolled back to block ${rollback.blockHeight}`\n              : `config NOT rolled back: ${rollback.error ?? \"unknown\"}`;\n            console.log(colors.yellow(`  ${rollbackNote}`));\n            return {\n              status: \"published\" as const,\n              ...configPublished,\n              image,\n              error: `Post-publish smoke failed (${cause}) — ${rollbackNote}`,\n            };\n          }\n          console.log(\n            colors.green(`  ${icons.ok} Post-publish smoke passed: ${smokeResult.summary ?? \"\"}`),\n          );\n        }\n      }\n\n      if (process.env.RAILWAY_TOKEN) {\n        const railwayService = input.service ?? nextSession.config?.ci?.railway?.service;\n        if (!railwayService) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: ci.railway.service is not configured in bos.config.json\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            error:\n              \"Config published but Railway deploy failed: ci.railway.service is not configured in bos.config.json\",\n          };\n        }\n        if (!image || !imageDigest) {\n          console.log();\n          console.log(\n            colors.yellow(\n              \"  Railway deploy skipped: no runtime image digest — set ci.image (or pass BOS_IMAGE_DIGEST) and make the image available\",\n            ),\n          );\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service: railwayService,\n            error:\n              \"Config published but Railway deploy requires a runtime image (set ci.image, or pass BOS_IMAGE_DIGEST for a pre-pushed image)\",\n          };\n        }\n\n        service = railwayService;\n        try {\n          await deployImageToRailway({\n            service: railwayService,\n            configDir: session.root,\n          });\n        } catch (error) {\n          const message = error instanceof Error ? error.message : String(error);\n          const railError =\n            message.includes(\"not found\") || message.includes(\"ENOENT\")\n              ? \"Railway CLI not found. Install it: npm i -g @railway/cli\"\n              : `Railway deploy failed: ${message}`;\n          console.log(colors.yellow(`  ${railError}`));\n          return {\n            status: \"published\" as const,\n            ...configPublished,\n            image,\n            service,\n            error: `Config published but ${railError}`,\n          };\n        }\n      } else {\n        console.log();\n        console.log(colors.yellow(\"  Railway deploy skipped (RAILWAY_TOKEN not set)\"));\n      }\n\n      return {\n        status: \"deployed\" as const,\n        ...configPublished,\n        image,\n        service,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AA+CA,eAAe,2BACb,OACgE;CAChE,IAAI;CACJ,IAAI;EACF,UAAU,MAAM,mBAAmB;GACjC,WAAW,MAAM;GACjB,WAAW,MAAM;GACjB,UAAU,MAAM;GAChB,OAAO;EACT,CAAC;CACH,SAAS,OAAO;EACd,OAAO;GACL,IAAI;GACJ,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAClG;CACF;CAEA,MAAM,WAAW,QAAQ;CACzB,IAAI,CAAC,UACH,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,eAAe,MAAM,uBAAuB,SAAS,KAAuB;CAClF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;EACL,IAAI;EACJ,OAAO;CACT;CAGF,MAAM,UAAU,qBACd,gBAAgB,MAAM,SAAS,KAAK,oBACpC,IAAI,KAAK,EAAC,CAAC,YAAY,CACzB;CACA,MAAM,SAAS,MAAM,gBAAgB;EACnC,WAAW;EACX,eAAe,MAAM;EACrB,WAAW,MAAM;EACjB,KAAK,MAAM;EACX,OAAO;EACP,QAAQ;EACR,SAAS,MAAM;EACf,UAAU;EACV,SAAS,MAAM;EACf,YAAY,MAAM;EAClB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,cAAc;CAChB,CAAC;CACD,IAAI,OAAO,WAAW,aACpB,OAAO;EACL,IAAI;EACJ,OAAO,4BAA4B,OAAO,SAAS,OAAO;CAC5D;CAEF,OAAO;EAAE,IAAI;EAAM,aAAa,OAAO,SAAS,WAAW;CAAE;AAC/D;AAEA,SAAgB,eAAe,SAAqB;CAClD,OAAO;EACL,SAAS,QAAQ,QAAQ,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE7D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;GAClB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;EACF,CAAC;EAED,UAAU,QAAQ,SAAS,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE/D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,EAAE,SAAS,WAAW,QAAQ,UAAU,CAAC;GAC/C,IAAI,CAAC,WAAW,CAAC,QACf,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI;GACJ,IAAI;IACF,UAAU,MAAM,mBAAmB;KACjC,WAAW;KACX,WAAW;KACX,UAAU,MAAM;KAChB,OAAO,MAAM;IACf,CAAC;GACH,SAAS,OAAO;IACd,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;IAClG;GACF;GAEA,IAAI,QAAQ,WAAW,GACrB,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,0BAA0B,QAAQ,GAAG,OAAO;GACrD;GAGF,MAAM,iBAAiB,QAAQ,KAAK,WAAW;IAC7C,aAAa,MAAM;IACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAClF,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;IAC/C,SAAS,kBAAkB,MAAM,KAAuB;GAC1D,EAAE;GAEF,IAAI,MAAM,UACR,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;GACX;GAGF,MAAM,SACJ,MAAM,YAAY,SACd,QAAQ,MAAM,UAAU;IACtB,MAAM,MAAM,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;IAC9E,OACE,OAAO,MAAM,WAAW,MAAM,MAAM,WACpC,IAAI,WAAW,MAAM,OAAiB;GAE1C,CAAC,IACD,MAAM,WACJ,QAAQ,KACR;GAER,IAAI,CAAC,QACH,OAAO;IACL,QAAQ;IACR,aAAa;IACb,SAAS;IACT,OAAO,MAAM,UACT,6BAA6B,MAAM,QAAQ,4CAC3C;GACN;GAGF,IAAI;GACJ,IAAI;IACF,YAAY,MAAM,yBAChB,SAAS,QAAQ,GAAG,UACpB,MAAM,QACR;GACF,QAAQ;IACN,YAAY;GACd;GACA,IAAI,aAAa,KAAK,UAAU,SAAS,MAAM,KAAK,UAAU,OAAO,KAAK,GACxE,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,MAAM,eAAe,MAAM,uBAAuB,OAAO,KAAuB;GAChF,MAAM,aAAa,aAAa,MAAM,KAAK,WAAW;IACpD,MAAM,MAAM;IACZ,IAAI,MAAM;IACV,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;GACjD,EAAE;GACF,IAAI,CAAC,aAAa,MAAM,aAAa,YACnC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,cAAc;IACd,OACE;GACJ;GAGF,IAAI,CAAC,aAAa,cAAc,CAAC,MAAM,OACrC,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OACE;GACJ;GAGF,MAAM,eAAe,gBAAgB,MAAM,OAAO,KAAK;GACvD,MAAM,UAAU,qBAAqB,+BAAc,IAAI,KAAK,EAAC,CAAC,YAAY,CAAC;GAE3E,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW;IACX,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO;IACP,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU;IACV,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,QAAQ,MAAM;IACd,UAAU,MAAM;IAChB,cAAc;GAChB,CAAC;GAED,OAAO;IACL,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS;IACT,GAAI,WAAW,SAAS,IAAI,EAAE,cAAc,WAAW,IAAI,CAAC;GAC9D;EACF,CAAC;EAED,QAAQ,QAAQ,OAAO,QAAQ,OAAO,EAAE,OAAO,cAAc;GAE3D,MAAM,UADO,QAAQ,IAAI,QAAQ,mBAAmB,UACjC,CAAC,CAAC;GACrB,IAAI,CAAC,SAAS,QACZ,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO;GACT;GAGF,IAAI,MAAM,YAAY;IACpB,IAAI,CAAC,QAAQ,QAAQ,WAAW,CAAC,QAAQ,OAAO,QAC9C,OAAO;KACL,QAAQ;KACR,aAAa;KACb,OAAO;IACT;IAEF,IAAI;KAMF,OAAO;MACL,QAAQ;MACR,aAAa;MACb,UAAS,MARa,qBAAqB;OAC3C,WAAW,QAAQ,OAAO;OAC1B,WAAW,QAAQ,OAAO;OAC1B,UAAU,MAAM;MAClB,CAAC,EAImB,CAAC,KAAK,WAAW;OACjC,KAAK,MAAM;OACX,aAAa,MAAM;OACnB,gBAAgB,IAAI,KAAK,OAAO,MAAM,iBAAiB,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY;OAClF,GAAK,MAAM,OAA2C,SAClD,EAAE,QAAS,MAAM,MAA8B,OAAO,IACtD,CAAC;OACL,GAAK,MAAM,OAAgD,cACvD,EAAE,aAAc,MAAM,MAAmC,YAAY,IACrE,CAAC;MACP,EAAE;KACJ;IACF,SAAS,OAAO;KACd,OAAO;MACL,QAAQ;MACR,aAAa;MACb,OAAO,oCAAoC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KAClG;IACF;GACF;GAEA,MAAM,mBAAmB,MAAM,eAAe,QAAQ,IAAI;GAC1D,IAAI,oBAAoB,CAAC,mBAAmB,gBAAgB,GAC1D,OAAO;IACL,QAAQ;IACR,aAAa;IACb,OAAO,yBAAyB,iBAAiB;GACnD;GAGF,MAAM,SAAS,MAAM,gBAAgB;IACnC,WAAW,QAAQ;IACnB,eAAe,QAAQ;IACvB,WAAW,QAAQ;IACnB,KAAK,MAAM;IACX,OAAO,MAAM;IACb,QAAQ,MAAM;IACd,SAAS,MAAM;IACf,UAAU,MAAM;IAChB,SAAS,MAAM;IACf,YAAY,MAAM;IAClB,UAAU,MAAM;IAChB,YAAY,MAAM;GACpB,CAAC;GAED,IAAI,OAAO,WAAW,SACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,OAAO;GACxB;GAGF,IAAI,OAAO,WAAW,WACpB,OAAO;IACL,QAAQ;IACR,aAAa,OAAO;IACpB,OAAO,OAAO;IACd,SAAS,OAAO;GAClB;GAGF,IAAI,cAAc;GAClB,IAAI,OAAO,eAAe;IACxB,MAAM,SAAS,MAAM,eAAe,EAAE,KAAK,QAAQ,KAAK,CAAC;IACzD,IAAI,QACF,cAAc;GAElB;GAEA,MAAM,kBAAkB;IACtB,aAAa,OAAO;IACpB,QAAQ,OAAO;IACf,aAAa,OAAO;IACpB,UAAU,OAAO;IACjB,OAAO,OAAO;IACd,SAAS,OAAO;IAChB,eAAe,OAAO;GACxB;GAEA,IAAI;GACJ,IAAI;GACJ,IAAI;GAEJ,MAAM,YAAY,uBAAuB;IAKvC,UAAU,gBAAgB;KACxB,SAAS,mBAAmB,SAAY,YAAY,QAAQ,IAAI;KAChE,YAAY,YAAY,QAAQ;KAChC,KAAK,QAAQ;IACf,CAAC;IACD,aAAa;IACb,WAAW,MAAM,UAAU;IAC3B,eAAe,WAAW,KAAK,QAAQ,MAAM,YAAY,CAAC;GAC5D,CAAC;GAED,IAAI,UAAU,SAAS,QAAQ;IAC7B,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,oBAAoB,UAAU,QAAQ,CAAC;GACnE,OAAO,IAAI,UAAU,SAAS,YAAY;IACxC,QAAQ,UAAU;IAClB,cAAc,UAAU;IACxB,QAAQ,IAAI;IACZ,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,0BAA0B,UAAU,MAAM,GAAG,UAAU,OAAO,MAAM,GAAG,EAAE,EAAE,EAC3F,CACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,IAAI;KACF,MAAM,cAAc,MAAM,kBAAkB;MAC1C,OAAO,UAAU;MACjB,WAAW,QAAQ;MACnB,SAAS,MAAM;KACjB,CAAC;KACD,QAAQ,YAAY;KACpB,cAAc,YAAY;KAC1B,QAAQ,IACN,OAAO,MACL,KAAK,MAAM,GAAG,gBAAgB,YAAY,MAAM,GAAG,YAAY,MAAM,YAAY,SAAS,KAAK,YAAY,OAAO,MAAM,GAAG,EAAE,EAAE,MAAM,IACvI,CACF;IACF,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,aACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,iEACA,4BAA4B;KAClC,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,CAAC;KAC5C,OAAO;MACL,QAAQ;MACR,GAAG;MACH,OAAO,wBAAwB;KACjC;IACF;GACF;GAOA,IAAI,MAAM,OAAO;IACf,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,iGACF,CACF;IACF,OAAO;KACL,QAAQ,IAAI;KACZ,QAAQ,IAAI,OAAO,KAAK,oCAAoC,CAAC;KAC7D,MAAM,cAAc,MAAM,SAAS;MACjC,OAAO,mBAAmB,OAAO,WAAW;MAC5C,SAAS,YAAY,QAAQ;MAC7B,SAAS,YAAY,QAAQ;KAC/B,CAAC;KACD,IAAI,CAAC,YAAY,IAAI;MACnB,MAAM,QAAQ,YAAY,SAAS;MACnC,QAAQ,IAAI;MACZ,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,IAAI,8BAA8B,OAAO,CAAC;MAC9E,IAAI,YAAY,WACd,QAAQ,IAAI,OAAO,OAAO,KAAK,YAAY,WAAW,CAAC;MAEzD,MAAM,UAAU,YAAY,QAAQ;MACpC,MAAM,SAAS,YAAY,QAAQ;MACnC,IAAI,CAAC,WAAW,CAAC,QAAQ;OACvB,QAAQ,IAAI,OAAO,OAAO,yDAAyD,CAAC;OACpF,OAAO;QACL,QAAQ;QACR,GAAG;QACH;QACA,OAAO,8BAA8B,MAAM;OAC7C;MACF;MACA,QAAQ,IAAI,OAAO,OAAO,sCAAsC,CAAC;MACjE,MAAM,WAAW,MAAM,2BAA2B;OAChD;OACA;OACA,KAAK,MAAM;OACX,eAAe,YAAY;OAC3B,WAAW,YAAY;OACvB,UAAU,MAAM;OAChB,SAAS,MAAM;OACf,YAAY,MAAM;OAClB,QAAQ,MAAM;OACd,SAAS,MAAM;MACjB,CAAC;MACD,MAAM,eAAe,SAAS,KAC1B,+BAA+B,SAAS,gBACxC,2BAA2B,SAAS,SAAS;MACjD,QAAQ,IAAI,OAAO,OAAO,KAAK,cAAc,CAAC;MAC9C,OAAO;OACL,QAAQ;OACR,GAAG;OACH;OACA,OAAO,8BAA8B,MAAM,MAAM;MACnD;KACF;KACA,QAAQ,IACN,OAAO,MAAM,KAAK,MAAM,GAAG,8BAA8B,YAAY,WAAW,IAAI,CACtF;IACF;GACF;GAEA,IAAI,QAAQ,IAAI,eAAe;IAC7B,MAAM,iBAAiB,MAAM,WAAW,YAAY,QAAQ,IAAI,SAAS;IACzE,IAAI,CAAC,gBAAgB;KACnB,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,mFACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,OACE;KACJ;IACF;IACA,IAAI,CAAC,SAAS,CAAC,aAAa;KAC1B,QAAQ,IAAI;KACZ,QAAQ,IACN,OAAO,OACL,0HACF,CACF;KACA,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA,SAAS;MACT,OACE;KACJ;IACF;IAEA,UAAU;IACV,IAAI;KACF,MAAM,qBAAqB;MACzB,SAAS;MACT,WAAW,QAAQ;KACrB,CAAC;IACH,SAAS,OAAO;KACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;KACrE,MAAM,YACJ,QAAQ,SAAS,WAAW,KAAK,QAAQ,SAAS,QAAQ,IACtD,6DACA,0BAA0B;KAChC,QAAQ,IAAI,OAAO,OAAO,KAAK,WAAW,CAAC;KAC3C,OAAO;MACL,QAAQ;MACR,GAAG;MACH;MACA;MACA,OAAO,wBAAwB;KACjC;IACF;GACF,OAAO;IACL,QAAQ,IAAI;IACZ,QAAQ,IAAI,OAAO,OAAO,kDAAkD,CAAC;GAC/E;GAEA,OAAO;IACL,QAAQ;IACR,GAAG;IACH;IACA;GACF;EACF,CAAC;CACH;AACF"}

package/dist/commands/smoke.cjs

@@ -0,0 +1,41 @@
+const require_shared = require('./shared.cjs');
+const require_smoke = require('../smoke.cjs');
+let effect = require("effect");
+
+//#region src/commands/smoke.ts
+function registerSmoke(builder) {
+	return { smoke: builder.smoke.handler(async ({ input, context }) => {
+		const deps = effect.Context.get(context["effect/context"], require_shared.BosDepsTag);
+		const account = input.account ?? deps.session?.config?.account;
+		const gateway = input.gateway ?? deps.session?.config?.domain;
+		if (!input.image) return {
+			status: "error",
+			error: "smoke requires an image ref — pass --image <ref>"
+		};
+		console.log(`smoke: booting ${input.image} on :${input.port}`);
+		const result = await require_smoke.runSmoke({
+			image: input.image,
+			port: input.port,
+			keep: input.keep,
+			...account ? { account } : {},
+			...gateway ? { gateway } : {},
+			...input.apiDatabaseUrl ? { apiDatabaseUrl: input.apiDatabaseUrl } : {},
+			...input.authDatabaseUrl ? { authDatabaseUrl: input.authDatabaseUrl } : {}
+		});
+		if (result.ok) return {
+			status: "ok",
+			image: result.image,
+			summary: result.summary
+		};
+		return {
+			status: "error",
+			image: result.image,
+			...result.diagnosis ? { diagnosis: result.diagnosis } : {},
+			error: result.error
+		};
+	}) };
+}
+
+//#endregion
+exports.registerSmoke = registerSmoke;
+//# sourceMappingURL=smoke.cjs.map

package/dist/commands/smoke.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.cjs","names":["Context","BosDepsTag","runSmoke"],"sources":["../../src/commands/smoke.ts"],"sourcesContent":["import { Context } from \"effect\";\nimport { runSmoke } from \"../smoke\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerSmoke(builder: BosBuilder) {\n  return {\n    smoke: builder.smoke.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const account = input.account ?? deps.session?.config?.account;\n      const gateway = input.gateway ?? deps.session?.config?.domain;\n\n      if (!input.image) {\n        return {\n          status: \"error\" as const,\n          error: \"smoke requires an image ref — pass --image <ref>\",\n        };\n      }\n\n      console.log(`smoke: booting ${input.image} on :${input.port}`);\n      const result = await runSmoke({\n        image: input.image,\n        port: input.port,\n        keep: input.keep,\n        ...(account ? { account } : {}),\n        ...(gateway ? { gateway } : {}),\n        ...(input.apiDatabaseUrl ? { apiDatabaseUrl: input.apiDatabaseUrl } : {}),\n        ...(input.authDatabaseUrl ? { authDatabaseUrl: input.authDatabaseUrl } : {}),\n      });\n\n      if (result.ok) {\n        return {\n          status: \"ok\" as const,\n          image: result.image,\n          summary: result.summary,\n        };\n      }\n      return {\n        status: \"error\" as const,\n        image: result.image,\n        ...(result.diagnosis ? { diagnosis: result.diagnosis } : {}),\n        error: result.error,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;AAIA,SAAgB,cAAc,SAAqB;CACjD,OAAO,EACL,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;EACzD,MAAM,OAAOA,eAAQ,IAAI,QAAQ,mBAAmBC,yBAAU;EAC9D,MAAM,UAAU,MAAM,WAAW,KAAK,SAAS,QAAQ;EACvD,MAAM,UAAU,MAAM,WAAW,KAAK,SAAS,QAAQ;EAEvD,IAAI,CAAC,MAAM,OACT,OAAO;GACL,QAAQ;GACR,OAAO;EACT;EAGF,QAAQ,IAAI,kBAAkB,MAAM,MAAM,OAAO,MAAM,MAAM;EAC7D,MAAM,SAAS,MAAMC,uBAAS;GAC5B,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC7B,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;GACvE,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;EAC5E,CAAC;EAED,IAAI,OAAO,IACT,OAAO;GACL,QAAQ;GACR,OAAO,OAAO;GACd,SAAS,OAAO;EAClB;EAEF,OAAO;GACL,QAAQ;GACR,OAAO,OAAO;GACd,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC1D,OAAO,OAAO;EAChB;CACF,CAAC,EACH;AACF"}

package/dist/commands/smoke.mjs

@@ -0,0 +1,41 @@
+import { BosDepsTag } from "./shared.mjs";
+import { runSmoke } from "../smoke.mjs";
+import { Context } from "effect";
+
+//#region src/commands/smoke.ts
+function registerSmoke(builder) {
+	return { smoke: builder.smoke.handler(async ({ input, context }) => {
+		const deps = Context.get(context["effect/context"], BosDepsTag);
+		const account = input.account ?? deps.session?.config?.account;
+		const gateway = input.gateway ?? deps.session?.config?.domain;
+		if (!input.image) return {
+			status: "error",
+			error: "smoke requires an image ref — pass --image <ref>"
+		};
+		console.log(`smoke: booting ${input.image} on :${input.port}`);
+		const result = await runSmoke({
+			image: input.image,
+			port: input.port,
+			keep: input.keep,
+			...account ? { account } : {},
+			...gateway ? { gateway } : {},
+			...input.apiDatabaseUrl ? { apiDatabaseUrl: input.apiDatabaseUrl } : {},
+			...input.authDatabaseUrl ? { authDatabaseUrl: input.authDatabaseUrl } : {}
+		});
+		if (result.ok) return {
+			status: "ok",
+			image: result.image,
+			summary: result.summary
+		};
+		return {
+			status: "error",
+			image: result.image,
+			...result.diagnosis ? { diagnosis: result.diagnosis } : {},
+			error: result.error
+		};
+	}) };
+}
+
+//#endregion
+export { registerSmoke };
+//# sourceMappingURL=smoke.mjs.map

package/dist/commands/smoke.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"smoke.mjs","names":[],"sources":["../../src/commands/smoke.ts"],"sourcesContent":["import { Context } from \"effect\";\nimport { runSmoke } from \"../smoke\";\nimport { type BosBuilder, BosDepsTag } from \"./shared\";\n\nexport function registerSmoke(builder: BosBuilder) {\n  return {\n    smoke: builder.smoke.handler(async ({ input, context }) => {\n      const deps = Context.get(context[\"effect/context\"], BosDepsTag);\n      const account = input.account ?? deps.session?.config?.account;\n      const gateway = input.gateway ?? deps.session?.config?.domain;\n\n      if (!input.image) {\n        return {\n          status: \"error\" as const,\n          error: \"smoke requires an image ref — pass --image <ref>\",\n        };\n      }\n\n      console.log(`smoke: booting ${input.image} on :${input.port}`);\n      const result = await runSmoke({\n        image: input.image,\n        port: input.port,\n        keep: input.keep,\n        ...(account ? { account } : {}),\n        ...(gateway ? { gateway } : {}),\n        ...(input.apiDatabaseUrl ? { apiDatabaseUrl: input.apiDatabaseUrl } : {}),\n        ...(input.authDatabaseUrl ? { authDatabaseUrl: input.authDatabaseUrl } : {}),\n      });\n\n      if (result.ok) {\n        return {\n          status: \"ok\" as const,\n          image: result.image,\n          summary: result.summary,\n        };\n      }\n      return {\n        status: \"error\" as const,\n        image: result.image,\n        ...(result.diagnosis ? { diagnosis: result.diagnosis } : {}),\n        error: result.error,\n      };\n    }),\n  };\n}\n"],"mappings":";;;;;AAIA,SAAgB,cAAc,SAAqB;CACjD,OAAO,EACL,OAAO,QAAQ,MAAM,QAAQ,OAAO,EAAE,OAAO,cAAc;EACzD,MAAM,OAAO,QAAQ,IAAI,QAAQ,mBAAmB,UAAU;EAC9D,MAAM,UAAU,MAAM,WAAW,KAAK,SAAS,QAAQ;EACvD,MAAM,UAAU,MAAM,WAAW,KAAK,SAAS,QAAQ;EAEvD,IAAI,CAAC,MAAM,OACT,OAAO;GACL,QAAQ;GACR,OAAO;EACT;EAGF,QAAQ,IAAI,kBAAkB,MAAM,MAAM,OAAO,MAAM,MAAM;EAC7D,MAAM,SAAS,MAAM,SAAS;GAC5B,OAAO,MAAM;GACb,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC7B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;GAC7B,GAAI,MAAM,iBAAiB,EAAE,gBAAgB,MAAM,eAAe,IAAI,CAAC;GACvE,GAAI,MAAM,kBAAkB,EAAE,iBAAiB,MAAM,gBAAgB,IAAI,CAAC;EAC5E,CAAC;EAED,IAAI,OAAO,IACT,OAAO;GACL,QAAQ;GACR,OAAO,OAAO;GACd,SAAS,OAAO;EAClB;EAEF,OAAO;GACL,QAAQ;GACR,OAAO,OAAO;GACd,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;GAC1D,OAAO,OAAO;EAChB;CACF,CAAC,EACH;AACF"}

package/dist/commands/upgrade.cjs

@@ -2,7 +2,7 @@ const require_runtime = require('../_virtual/_rolldown/runtime.cjs');
 const require_config = require('../config.cjs');
 const require_theme = require('../utils/theme.cjs');
 const require_resolution_session = require('../resolution/session.cjs');
-const require_mf = require('../mf.cjs');
+const require_federation = require('../federation.cjs');
 const require_build = require('../build.cjs');
 const require_code_artifacts = require('../code-artifacts.cjs');
 const require_dev_program = require('../dev-program.cjs');
@@ -331,7 +331,7 @@ function registerUpgrade(builder) {
 					remotes: []
 				};
 			}
-			const report = await require_mf.checkFederationCompat(authored, { timeoutMs: input.timeoutMs });
+			const report = await require_federation.checkFederationCompat(authored, { timeoutMs: input.timeoutMs });
 			return {
 				status: report.ok ? "ok" : "fail",
 				hostVersion: report.hostVersion,