gcp-job-runner 1.4.1 → 1.6.0

package/dist/cli.mjs

@@ -2,6 +2,7 @@
 import { discoverJobs } from "./discover-jobs.mjs";
 import { promptForArgs, selectJob } from "./interactive.mjs";
 import { runJob } from "./run-job.mjs";
+import { parseEnvFiles } from "./env-file.mjs";
 import { createOrUpdateJob, deployIfChanged, prepareImage } from "./cloud/deploy.mjs";
 import { execute } from "./cloud/execute.mjs";
 import { deriveJobResourceName } from "./cloud/job-name.mjs";
@@ -193,10 +194,15 @@ async function handleLocalRun(options) {
 	const { config, envName, envConfig, jobsDirectory, jobNameFromArgs, jobFlags, isInteractive } = options;
 	/** Set environment variables for local execution */
 	process.env.NODE_ENV ??= "development";
-	process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;
 	process.env.USE_CONSOLE_LOG ??= "true";
 	process.env.LOG_COLORIZE ??= "true";
+	/** Load envFile variables (don't overwrite existing process.env values) */
+	const envFileVars = parseEnvFiles(envConfig.envFile);
+	for (const [key, value] of Object.entries(envFileVars)) process.env[key] ??= value;
+	/** Explicit env values override envFile values */
 	if (envConfig.env) for (const [key, value] of Object.entries(envConfig.env)) process.env[key] = value;
+	/** Project always takes highest precedence */
+	process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;
 	if (envConfig.secrets && envConfig.secrets.length > 0) {
 		const secrets = await getSecrets(envConfig.secrets);
 		for (const [key, value] of Object.entries(secrets)) process.env[key] = value;

package/dist/cli.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { execSync } from \"node:child_process\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { consola } from \"consola\";\nimport type { ZodObject, ZodRawShape } from \"zod\";\nimport type { RunnerConfig } from \"./config\";\nimport {\n  createOrUpdateJob,\n  deployIfChanged,\n  prepareImage,\n} from \"./cloud/deploy\";\nimport { execute } from \"./cloud/execute\";\nimport { deriveJobResourceName } from \"./cloud/job-name\";\nimport { discoverJobs } from \"./discover-jobs\";\nimport { promptForArgs, selectJob } from \"./interactive\";\nimport { runJob } from \"./run-job\";\nimport { getSecrets } from \"./secrets\";\nimport type { JobFunction } from \"./types\";\n\nconst BIN_NAME = \"job\";\nconst CONFIG_FILE = \"job-runner.config.ts\";\nconst DEFAULT_BUILD_COMMAND = \"turbo build\";\nconst DEFAULT_JOBS_DIRECTORY = \"dist/jobs\";\n\nconst USAGE = `Usage: ${BIN_NAME} local run <env> <job-name> [options]\n       ${BIN_NAME} cloud run <env> <job-name> [options]\n       ${BIN_NAME} cloud deploy <env>\n       ${BIN_NAME} --list\n\nCloud run options:\n  --tasks <n>         Number of parallel tasks for this execution\n  --parallelism <n>   Max concurrent tasks (sets job resource default)`;\n\nfunction validateInteger(value: number, flagName: string): number {\n  if (Number.isNaN(value) || !Number.isInteger(value) || value < 0) {\n    consola.error(\n      `Invalid value for ${flagName}: expected a non-negative integer`,\n    );\n    process.exit(1);\n  }\n  return value;\n}\n\n/**\n * Extract a numeric flag value from args.\n * Supports both `--flag N` and `--flag=N` syntax.\n * Returns undefined if the flag is not present.\n */\nfunction extractNumberFlag(\n  args: string[],\n  flagName: string,\n): number | undefined {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i]!;\n\n    if (arg === flagName) {\n      const next = args[i + 1];\n      if (next === undefined || next.startsWith(\"-\")) {\n        consola.error(`${flagName} requires a value`);\n        process.exit(1);\n      }\n      return validateInteger(Number(next), flagName);\n    }\n\n    if (arg.startsWith(`${flagName}=`)) {\n      return validateInteger(Number(arg.slice(flagName.length + 1)), flagName);\n    }\n  }\n\n  return undefined;\n}\n\nasync function main(): Promise<void> {\n  const args = process.argv.slice(2);\n\n  /** Extract flags from anywhere in args */\n  const noBuild = args.includes(\"--no-build\");\n  const isInteractive = args.includes(\"--interactive\") || args.includes(\"-i\");\n  const isAsync = args.includes(\"--async\");\n\n  /** Determine mode early so cloud-only flags are only parsed in cloud mode */\n  const mode = args.find((arg) => !arg.startsWith(\"-\"));\n  const isCloudMode = mode === \"cloud\";\n\n  const tasks = isCloudMode ? extractNumberFlag(args, \"--tasks\") : undefined;\n  if (tasks === 0) {\n    consola.error(\"--tasks must be at least 1\");\n    process.exit(1);\n  }\n  const parallelism = isCloudMode\n    ? extractNumberFlag(args, \"--parallelism\")\n    : undefined;\n\n  const configPath = path.resolve(process.cwd(), CONFIG_FILE);\n\n  /** Load config directly (config should only depend on gcp-job-runner) */\n  let config: RunnerConfig;\n  try {\n    const module = (await import(configPath)) as { default: RunnerConfig };\n    config = module.default;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    consola.error(\n      `Failed to load runner config from ${configPath}\\n${message}`,\n    );\n    process.exit(1);\n  }\n\n  /** Resolve jobs directory with default */\n  const jobsDirectory =\n    config.jobsDirectory ?? path.resolve(process.cwd(), DEFAULT_JOBS_DIRECTORY);\n\n  const envNames = Object.keys(config.environments);\n\n  /** Handle --list: discover and print all available jobs */\n  if (args.includes(\"--list\")) {\n    if (!noBuild && config.buildCommand !== false) {\n      const buildCommand = config.buildCommand ?? DEFAULT_BUILD_COMMAND;\n      runBuild(buildCommand);\n    }\n\n    const jobs = await discoverJobs(jobsDirectory);\n    if (jobs.length === 0) {\n      consola.info(\"No jobs found.\");\n    } else {\n      consola.info(\"Available jobs:\");\n      for (const job of jobs) {\n        consola.log(`  ${job.name}`);\n      }\n    }\n    return;\n  }\n\n  /**\n   * Parse positional arguments. In cloud mode, skip values consumed by\n   * numeric flags like `--tasks 5` so that `5` is not treated as a positional.\n   */\n  const consumedIndices = new Set<number>();\n  if (isCloudMode) {\n    for (let i = 0; i < args.length; i++) {\n      const arg = args[i]!;\n      if (\n        (arg === \"--tasks\" || arg === \"--parallelism\") &&\n        i + 1 < args.length\n      ) {\n        consumedIndices.add(i + 1);\n      }\n    }\n  }\n\n  const positionals = args.filter(\n    (arg, index) => !arg.startsWith(\"-\") && !consumedIndices.has(index),\n  );\n\n  if (mode !== \"local\" && mode !== \"cloud\") {\n    consola.error(\n      `Unknown or missing mode \"${mode ?? \"\"}\".\\n\\n` +\n        `${USAGE}\\n\\n` +\n        `Environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  const action = positionals[1];\n  if (mode === \"cloud\" && action !== \"run\" && action !== \"deploy\") {\n    consola.error(\n      `Unknown or missing action \"${action ?? \"\"}\" for cloud mode.\\n\\n` + USAGE,\n    );\n    process.exit(1);\n  }\n  if (mode === \"local\" && action !== \"run\") {\n    consola.error(\n      `Unknown or missing action \"${action ?? \"\"}\" for local mode.\\n\\n` + USAGE,\n    );\n    process.exit(1);\n  }\n\n  const envName = positionals[2];\n  if (!envName) {\n    consola.error(\n      `No environment specified.\\n\\n` +\n        `${USAGE}\\n\\n` +\n        `Environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  if (!envNames.includes(envName)) {\n    consola.error(\n      `Unknown environment \"${envName}\".\\n\\n` +\n        `Available environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  const envConfig = config.environments[envName]!;\n\n  /**\n   * Remaining positionals after env become the job name/path. For example\n   * `job cloud run stag test/countdown` -> positionals[3] = \"test/countdown\".\n   */\n  const jobNameFromArgs = positionals[3];\n\n  /**\n   * Collect job flags: everything after `<env>` in the original args that\n   * isn't a consumed positional or a known global flag.\n   */\n  const consumedPositionals = new Set(\n    [mode, action, envName, jobNameFromArgs].filter(Boolean),\n  );\n  const globalFlags = new Set([\n    \"--no-build\",\n    \"--interactive\",\n    \"-i\",\n    \"--async\",\n    \"--list\",\n  ]);\n\n  /** --tasks and --parallelism are cloud-only; don't strip them in local mode */\n  if (mode === \"cloud\") {\n    globalFlags.add(\"--tasks\");\n    globalFlags.add(\"--parallelism\");\n  }\n\n  const envIndex = args.indexOf(envName);\n  const jobFlags = args.slice(envIndex + 1).filter((arg, index, arr) => {\n    if (consumedPositionals.has(arg)) return false;\n    if (globalFlags.has(arg)) return false;\n    if (mode === \"cloud\") {\n      /** Filter out `--flag=value` forms of number flags */\n      if (arg.startsWith(\"--tasks=\") || arg.startsWith(\"--parallelism=\"))\n        return false;\n      /** Filter out values that follow --tasks or --parallelism */\n      const previous = arr[index - 1];\n      if (previous === \"--tasks\" || previous === \"--parallelism\") return false;\n    }\n    return true;\n  });\n\n  /** Build unless skipped */\n  if (!noBuild && config.buildCommand !== false) {\n    const buildCommand = config.buildCommand ?? DEFAULT_BUILD_COMMAND;\n    runBuild(buildCommand);\n  }\n\n  if (mode === \"local\") {\n    await handleLocalRun({\n      config,\n      envName,\n      envConfig,\n      jobsDirectory,\n      jobNameFromArgs,\n      jobFlags,\n      isInteractive,\n    });\n  } else if (action === \"deploy\") {\n    await handleCloudDeploy({ config, envConfig });\n  } else {\n    await handleCloudRun({\n      config,\n      envConfig,\n      jobsDirectory,\n      jobNameFromArgs,\n      jobFlags,\n      isInteractive,\n      isAsync,\n      tasks,\n      parallelism,\n    });\n  }\n}\n\ninterface LocalRunOptions {\n  config: RunnerConfig;\n  envName: string;\n  envConfig: RunnerConfig[\"environments\"][string];\n  jobsDirectory: string;\n  jobNameFromArgs: string | undefined;\n  jobFlags: string[];\n  isInteractive: boolean;\n}\n\nasync function handleLocalRun(options: LocalRunOptions): Promise<void> {\n  const {\n    config,\n    envName,\n    envConfig,\n    jobsDirectory,\n    jobNameFromArgs,\n    jobFlags,\n    isInteractive,\n  } = options;\n\n  /** Set environment variables for local execution */\n  process.env.NODE_ENV ??= \"development\";\n  process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;\n  process.env.USE_CONSOLE_LOG ??= \"true\";\n  process.env.LOG_COLORIZE ??= \"true\";\n\n  if (envConfig.env) {\n    for (const [key, value] of Object.entries(envConfig.env)) {\n      process.env[key] = value;\n    }\n  }\n\n  if (envConfig.secrets && envConfig.secrets.length > 0) {\n    const secrets = await getSecrets(envConfig.secrets);\n    for (const [key, value] of Object.entries(secrets)) {\n      process.env[key] = value;\n    }\n  }\n\n  if (isInteractive) {\n    const { jobArgv } = await resolveInteractiveJob(jobsDirectory);\n\n    process.argv = [process.argv[0]!, process.argv[1]!, ...jobArgv];\n\n    const commandPrefix = `${BIN_NAME} local run ${envName}`;\n\n    await runJob({\n      jobsDirectory,\n      initialize: config.initialize,\n      logger: config.logger,\n      commandPrefix,\n    });\n    return;\n  }\n\n  if (!jobNameFromArgs) {\n    consola.error(\n      `No job name specified.\\n\\n` +\n        `Usage: ${BIN_NAME} local run ${envName} <job-name> [options]\\n` +\n        `       ${BIN_NAME} local run ${envName} -i`,\n    );\n    process.exit(1);\n  }\n\n  /**\n   * Rewrite process.argv so runJob sees the job name as the first positional\n   * argument, followed by any job-specific flags.\n   */\n  process.argv = [\n    process.argv[0]!,\n    process.argv[1]!,\n    jobNameFromArgs,\n    ...jobFlags,\n  ];\n\n  const commandPrefix = `${BIN_NAME} local run ${envName}`;\n\n  await runJob({\n    jobsDirectory,\n    initialize: config.initialize,\n    logger: config.logger,\n    commandPrefix,\n  });\n}\n\ninterface CloudDeployOptions {\n  config: RunnerConfig;\n  envConfig: RunnerConfig[\"environments\"][string];\n}\n\nasync function handleCloudDeploy(options: CloudDeployOptions): Promise<void> {\n  const { config, envConfig } = options;\n  const cloud = config.cloud;\n\n  if (!cloud) {\n    consola.error(\n      \"No cloud configuration found in runner config.\\n\" +\n        \"Add a `cloud` section to your job-runner.config.ts\",\n    );\n    process.exit(1);\n  }\n\n  const serviceDirectory = process.cwd();\n\n  const { imageUri } = await prepareImage({\n    cloud,\n    envConfig,\n    serviceDirectory,\n  });\n\n  consola.info(`Image: ${imageUri}`);\n  consola.success(\"Deploy complete\");\n}\n\ninterface CloudRunOptions {\n  config: RunnerConfig;\n  envConfig: RunnerConfig[\"environments\"][string];\n  jobsDirectory: string;\n  jobNameFromArgs: string | undefined;\n  jobFlags: string[];\n  isInteractive: boolean;\n  isAsync: boolean;\n  tasks?: number;\n  parallelism?: number;\n}\n\nasync function handleCloudRun(options: CloudRunOptions): Promise<void> {\n  const {\n    config,\n    envConfig,\n    jobsDirectory,\n    jobNameFromArgs,\n    jobFlags,\n    isInteractive,\n    isAsync,\n    tasks,\n    parallelism,\n  } = options;\n\n  const cloud = config.cloud;\n\n  if (!cloud) {\n    consola.error(\n      \"No cloud configuration found in runner config.\\n\" +\n        \"Add a `cloud` section to your job-runner.config.ts\",\n    );\n    process.exit(1);\n  }\n\n  /** Override parallelism from CLI flag */\n  if (parallelism !== undefined) {\n    cloud.resources = { ...cloud.resources, parallelism };\n  }\n\n  const serviceDirectory = process.cwd();\n\n  /** Determine job name and argv */\n  let jobArgv: string[];\n\n  if (isInteractive) {\n    const result = await resolveInteractiveJob(jobsDirectory);\n    jobArgv = result.jobArgv;\n  } else {\n    if (!jobNameFromArgs) {\n      consola.error(\n        `No job name specified.\\n\\n` +\n          `Usage: ${BIN_NAME} cloud run <env> <job-name> [options]\\n` +\n          `       ${BIN_NAME} cloud run <env> -i`,\n      );\n      process.exit(1);\n    }\n    jobArgv = [jobNameFromArgs, ...jobFlags];\n  }\n\n  /** Build and push image if changed */\n  const { imageUri } = await deployIfChanged({\n    cloud,\n    envConfig,\n    serviceDirectory,\n  });\n\n  consola.info(`Image: ${imageUri}`);\n\n  /** Derive per-script Cloud Run Job name */\n  const jobScript = jobArgv[0]!;\n  const jobResourceName = deriveJobResourceName(jobScript);\n  const region = cloud.region ?? \"us-central1\";\n\n  /** Ensure per-script Cloud Run Job exists with current image */\n  await createOrUpdateJob({\n    cloud,\n    envConfig,\n    jobName: jobResourceName,\n    imageUri,\n    region,\n    project: envConfig.project,\n  });\n\n  /** Execute the per-script Cloud Run Job */\n  await execute({\n    jobResourceName,\n    region,\n    project: envConfig.project,\n    jobArgv,\n    async: isAsync,\n    tasks,\n  });\n}\n\n/**\n * Interactively select a job and prompt for arguments.\n * Returns the job name and the complete jobArgv array.\n */\nasync function resolveInteractiveJob(\n  jobsDirectory: string,\n): Promise<{ jobName: string; jobArgv: string[] }> {\n  const jobName = await selectJob(jobsDirectory);\n\n  consola.info(`Selected job: ${jobName}`);\n\n  /**\n   * Set console-friendly env vars before importing the module, since\n   * importing may initialize a structured logger like pino.\n   */\n  process.env.USE_CONSOLE_LOG ??= \"true\";\n  process.env.LOG_COLORIZE ??= \"true\";\n\n  const parts = jobName.split(\"/\");\n  const fileName = parts.pop() ?? \"\";\n  const subDirectories = parts;\n  const fileLocation = path.join(jobsDirectory, ...subDirectories);\n  const modulePath = path.resolve(fileLocation, `${fileName}.mjs`);\n\n  let schema: ZodObject<ZodRawShape> | undefined;\n  try {\n    const moduleObject = (await import(modulePath)) as Record<string, unknown>;\n    const fn = moduleObject.default as JobFunction | undefined;\n    schema = fn?.__metadata?.schema;\n  } catch {\n    /** Module might not exist yet or have errors - proceed without schema */\n  }\n\n  /** Prompt for arguments if schema exists */\n  let args: Record<string, unknown> = {};\n  if (schema && Object.keys(schema.shape).length > 0) {\n    consola.info(\"Enter arguments for the job:\");\n    args = await promptForArgs(schema);\n  }\n\n  const jobArgv = [jobName];\n  if (Object.keys(args).length > 0) {\n    jobArgv.push(\"--args\", JSON.stringify(args));\n  }\n\n  return { jobName, jobArgv };\n}\n\n/**\n * Run the build command to compile workspace dependencies.\n * Shows a spinner and hides output unless the build fails.\n */\nfunction runBuild(command: string): void {\n  consola.start(\"Building jobs source code...\");\n\n  try {\n    execSync(command, {\n      stdio: \"pipe\",\n      encoding: \"utf-8\",\n    });\n    consola.success(\"Build complete\");\n  } catch (error) {\n    consola.fail(\"Build failed\");\n\n    /** Show the build output on failure */\n    if (error && typeof error === \"object\" && \"stdout\" in error) {\n      const stdout = (error as { stdout?: string }).stdout;\n      if (stdout) {\n        consola.log(stdout);\n      }\n    }\n    if (error && typeof error === \"object\" && \"stderr\" in error) {\n      const stderr = (error as { stderr?: string }).stderr;\n      if (stderr) {\n        consola.log(stderr);\n      }\n    }\n\n    process.exit(1);\n  }\n}\n\nawait main();\n"],"mappings":";;;;;;;;;;;;;;AAqBA,MAAM,WAAW;AACjB,MAAM,cAAc;AACpB,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAE/B,MAAM,QAAQ,UAAU,SAAS;SACxB,SAAS;SACT,SAAS;SACT,SAAS;;;;;AAMlB,SAAS,gBAAgB,OAAe,UAA0B;AAChE,KAAI,OAAO,MAAM,MAAM,IAAI,CAAC,OAAO,UAAU,MAAM,IAAI,QAAQ,GAAG;AAChE,UAAQ,MACN,qBAAqB,SAAS,mCAC/B;AACD,UAAQ,KAAK,EAAE;;AAEjB,QAAO;;;;;;;AAQT,SAAS,kBACP,MACA,UACoB;AACpB,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AAEjB,MAAI,QAAQ,UAAU;GACpB,MAAM,OAAO,KAAK,IAAI;AACtB,OAAI,SAAS,UAAa,KAAK,WAAW,IAAI,EAAE;AAC9C,YAAQ,MAAM,GAAG,SAAS,mBAAmB;AAC7C,YAAQ,KAAK,EAAE;;AAEjB,UAAO,gBAAgB,OAAO,KAAK,EAAE,SAAS;;AAGhD,MAAI,IAAI,WAAW,GAAG,SAAS,GAAG,CAChC,QAAO,gBAAgB,OAAO,IAAI,MAAM,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS;;;AAO9E,eAAe,OAAsB;CACnC,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;;CAGlC,MAAM,UAAU,KAAK,SAAS,aAAa;CAC3C,MAAM,gBAAgB,KAAK,SAAS,gBAAgB,IAAI,KAAK,SAAS,KAAK;CAC3E,MAAM,UAAU,KAAK,SAAS,UAAU;;CAGxC,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC;CACrD,MAAM,cAAc,SAAS;CAE7B,MAAM,QAAQ,cAAc,kBAAkB,MAAM,UAAU,GAAG;AACjE,KAAI,UAAU,GAAG;AACf,UAAQ,MAAM,6BAA6B;AAC3C,UAAQ,KAAK,EAAE;;CAEjB,MAAM,cAAc,cAChB,kBAAkB,MAAM,gBAAgB,GACxC;CAEJ,MAAM,aAAa,KAAK,QAAQ,QAAQ,KAAK,EAAE,YAAY;;CAG3D,IAAI;AACJ,KAAI;AAEF,YADgB,MAAM,OAAO,aACb;UACT,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,UAAQ,MACN,qCAAqC,WAAW,IAAI,UACrD;AACD,UAAQ,KAAK,EAAE;;;CAIjB,MAAM,gBACJ,OAAO,iBAAiB,KAAK,QAAQ,QAAQ,KAAK,EAAE,uBAAuB;CAE7E,MAAM,WAAW,OAAO,KAAK,OAAO,aAAa;;AAGjD,KAAI,KAAK,SAAS,SAAS,EAAE;AAC3B,MAAI,CAAC,WAAW,OAAO,iBAAiB,MAEtC,UADqB,OAAO,gBAAgB,sBACtB;EAGxB,MAAM,OAAO,MAAM,aAAa,cAAc;AAC9C,MAAI,KAAK,WAAW,EAClB,SAAQ,KAAK,iBAAiB;OACzB;AACL,WAAQ,KAAK,kBAAkB;AAC/B,QAAK,MAAM,OAAO,KAChB,SAAQ,IAAI,KAAK,IAAI,OAAO;;AAGhC;;;;;;CAOF,MAAM,kCAAkB,IAAI,KAAa;AACzC,KAAI,YACF,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,OACG,QAAQ,aAAa,QAAQ,oBAC9B,IAAI,IAAI,KAAK,OAEb,iBAAgB,IAAI,IAAI,EAAE;;CAKhC,MAAM,cAAc,KAAK,QACtB,KAAK,UAAU,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,gBAAgB,IAAI,MAAM,CACpE;AAED,KAAI,SAAS,WAAW,SAAS,SAAS;AACxC,UAAQ,MACN,4BAA4B,QAAQ,GAAG,QAClC,MAAM,oBACQ,SAAS,KAAK,KAAK,GACvC;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,SAAS,YAAY;AAC3B,KAAI,SAAS,WAAW,WAAW,SAAS,WAAW,UAAU;AAC/D,UAAQ,MACN,8BAA8B,UAAU,GAAG,yBAAyB,MACrE;AACD,UAAQ,KAAK,EAAE;;AAEjB,KAAI,SAAS,WAAW,WAAW,OAAO;AACxC,UAAQ,MACN,8BAA8B,UAAU,GAAG,yBAAyB,MACrE;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,UAAU,YAAY;AAC5B,KAAI,CAAC,SAAS;AACZ,UAAQ,MACN,gCACK,MAAM,oBACQ,SAAS,KAAK,KAAK,GACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,SAAS,SAAS,QAAQ,EAAE;AAC/B,UAAQ,MACN,wBAAwB,QAAQ,gCACH,SAAS,KAAK,KAAK,GACjD;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,YAAY,OAAO,aAAa;;;;;CAMtC,MAAM,kBAAkB,YAAY;;;;;CAMpC,MAAM,sBAAsB,IAAI,IAC9B;EAAC;EAAM;EAAQ;EAAS;EAAgB,CAAC,OAAO,QAAQ,CACzD;CACD,MAAM,cAAc,IAAI,IAAI;EAC1B;EACA;EACA;EACA;EACA;EACD,CAAC;;AAGF,KAAI,SAAS,SAAS;AACpB,cAAY,IAAI,UAAU;AAC1B,cAAY,IAAI,gBAAgB;;CAGlC,MAAM,WAAW,KAAK,QAAQ,QAAQ;CACtC,MAAM,WAAW,KAAK,MAAM,WAAW,EAAE,CAAC,QAAQ,KAAK,OAAO,QAAQ;AACpE,MAAI,oBAAoB,IAAI,IAAI,CAAE,QAAO;AACzC,MAAI,YAAY,IAAI,IAAI,CAAE,QAAO;AACjC,MAAI,SAAS,SAAS;;AAEpB,OAAI,IAAI,WAAW,WAAW,IAAI,IAAI,WAAW,iBAAiB,CAChE,QAAO;;GAET,MAAM,WAAW,IAAI,QAAQ;AAC7B,OAAI,aAAa,aAAa,aAAa,gBAAiB,QAAO;;AAErE,SAAO;GACP;;AAGF,KAAI,CAAC,WAAW,OAAO,iBAAiB,MAEtC,UADqB,OAAO,gBAAgB,sBACtB;AAGxB,KAAI,SAAS,QACX,OAAM,eAAe;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;UACO,WAAW,SACpB,OAAM,kBAAkB;EAAE;EAAQ;EAAW,CAAC;KAE9C,OAAM,eAAe;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAcN,eAAe,eAAe,SAAyC;CACrE,MAAM,EACJ,QACA,SACA,WACA,eACA,iBACA,UACA,kBACE;;AAGJ,SAAQ,IAAI,aAAa;AACzB,SAAQ,IAAI,uBAAuB,UAAU;AAC7C,SAAQ,IAAI,oBAAoB;AAChC,SAAQ,IAAI,iBAAiB;AAE7B,KAAI,UAAU,IACZ,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,IAAI,CACtD,SAAQ,IAAI,OAAO;AAIvB,KAAI,UAAU,WAAW,UAAU,QAAQ,SAAS,GAAG;EACrD,MAAM,UAAU,MAAM,WAAW,UAAU,QAAQ;AACnD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,SAAQ,IAAI,OAAO;;AAIvB,KAAI,eAAe;EACjB,MAAM,EAAE,YAAY,MAAM,sBAAsB,cAAc;AAE9D,UAAQ,OAAO;GAAC,QAAQ,KAAK;GAAK,QAAQ,KAAK;GAAK,GAAG;GAAQ;EAE/D,MAAM,gBAAgB,GAAG,SAAS,aAAa;AAE/C,QAAM,OAAO;GACX;GACA,YAAY,OAAO;GACnB,QAAQ,OAAO;GACf;GACD,CAAC;AACF;;AAGF,KAAI,CAAC,iBAAiB;AACpB,UAAQ,MACN,oCACY,SAAS,aAAa,QAAQ,gCAC9B,SAAS,aAAa,QAAQ,KAC3C;AACD,UAAQ,KAAK,EAAE;;;;;;AAOjB,SAAQ,OAAO;EACb,QAAQ,KAAK;EACb,QAAQ,KAAK;EACb;EACA,GAAG;EACJ;CAED,MAAM,gBAAgB,GAAG,SAAS,aAAa;AAE/C,OAAM,OAAO;EACX;EACA,YAAY,OAAO;EACnB,QAAQ,OAAO;EACf;EACD,CAAC;;AAQJ,eAAe,kBAAkB,SAA4C;CAC3E,MAAM,EAAE,QAAQ,cAAc;CAC9B,MAAM,QAAQ,OAAO;AAErB,KAAI,CAAC,OAAO;AACV,UAAQ,MACN,qGAED;AACD,UAAQ,KAAK,EAAE;;CAKjB,MAAM,EAAE,aAAa,MAAM,aAAa;EACtC;EACA;EACA,kBALuB,QAAQ,KAAK;EAMrC,CAAC;AAEF,SAAQ,KAAK,UAAU,WAAW;AAClC,SAAQ,QAAQ,kBAAkB;;AAepC,eAAe,eAAe,SAAyC;CACrE,MAAM,EACJ,QACA,WACA,eACA,iBACA,UACA,eACA,SACA,OACA,gBACE;CAEJ,MAAM,QAAQ,OAAO;AAErB,KAAI,CAAC,OAAO;AACV,UAAQ,MACN,qGAED;AACD,UAAQ,KAAK,EAAE;;;AAIjB,KAAI,gBAAgB,OAClB,OAAM,YAAY;EAAE,GAAG,MAAM;EAAW;EAAa;CAGvD,MAAM,mBAAmB,QAAQ,KAAK;;CAGtC,IAAI;AAEJ,KAAI,cAEF,YADe,MAAM,sBAAsB,cAAc,EACxC;MACZ;AACL,MAAI,CAAC,iBAAiB;AACpB,WAAQ,MACN,oCACY,SAAS,gDACT,SAAS,qBACtB;AACD,WAAQ,KAAK,EAAE;;AAEjB,YAAU,CAAC,iBAAiB,GAAG,SAAS;;;CAI1C,MAAM,EAAE,aAAa,MAAM,gBAAgB;EACzC;EACA;EACA;EACD,CAAC;AAEF,SAAQ,KAAK,UAAU,WAAW;;CAGlC,MAAM,YAAY,QAAQ;CAC1B,MAAM,kBAAkB,sBAAsB,UAAU;CACxD,MAAM,SAAS,MAAM,UAAU;;AAG/B,OAAM,kBAAkB;EACtB;EACA;EACA,SAAS;EACT;EACA;EACA,SAAS,UAAU;EACpB,CAAC;;AAGF,OAAM,QAAQ;EACZ;EACA;EACA,SAAS,UAAU;EACnB;EACA,OAAO;EACP;EACD,CAAC;;;;;;AAOJ,eAAe,sBACb,eACiD;CACjD,MAAM,UAAU,MAAM,UAAU,cAAc;AAE9C,SAAQ,KAAK,iBAAiB,UAAU;;;;;AAMxC,SAAQ,IAAI,oBAAoB;AAChC,SAAQ,IAAI,iBAAiB;CAE7B,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAChC,MAAM,WAAW,MAAM,KAAK,IAAI;CAChC,MAAM,iBAAiB;CACvB,MAAM,eAAe,KAAK,KAAK,eAAe,GAAG,eAAe;CAChE,MAAM,aAAa,KAAK,QAAQ,cAAc,GAAG,SAAS,MAAM;CAEhE,IAAI;AACJ,KAAI;AAGF,YAFsB,MAAM,OAAO,aACX,SACX,YAAY;SACnB;;CAKR,IAAI,OAAgC,EAAE;AACtC,KAAI,UAAU,OAAO,KAAK,OAAO,MAAM,CAAC,SAAS,GAAG;AAClD,UAAQ,KAAK,+BAA+B;AAC5C,SAAO,MAAM,cAAc,OAAO;;CAGpC,MAAM,UAAU,CAAC,QAAQ;AACzB,KAAI,OAAO,KAAK,KAAK,CAAC,SAAS,EAC7B,SAAQ,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC;AAG9C,QAAO;EAAE;EAAS;EAAS;;;;;;AAO7B,SAAS,SAAS,SAAuB;AACvC,SAAQ,MAAM,+BAA+B;AAE7C,KAAI;AACF,WAAS,SAAS;GAChB,OAAO;GACP,UAAU;GACX,CAAC;AACF,UAAQ,QAAQ,iBAAiB;UAC1B,OAAO;AACd,UAAQ,KAAK,eAAe;;AAG5B,MAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OAAO;GAC3D,MAAM,SAAU,MAA8B;AAC9C,OAAI,OACF,SAAQ,IAAI,OAAO;;AAGvB,MAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OAAO;GAC3D,MAAM,SAAU,MAA8B;AAC9C,OAAI,OACF,SAAQ,IAAI,OAAO;;AAIvB,UAAQ,KAAK,EAAE;;;AAInB,MAAM,MAAM"}
+{"version":3,"file":"cli.mjs","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n\nimport { execSync } from \"node:child_process\";\nimport path from \"node:path\";\nimport process from \"node:process\";\nimport { consola } from \"consola\";\nimport type { ZodObject, ZodRawShape } from \"zod\";\nimport type { RunnerConfig } from \"./config\";\nimport {\n  createOrUpdateJob,\n  deployIfChanged,\n  prepareImage,\n} from \"./cloud/deploy\";\nimport { execute } from \"./cloud/execute\";\nimport { deriveJobResourceName } from \"./cloud/job-name\";\nimport { discoverJobs } from \"./discover-jobs\";\nimport { promptForArgs, selectJob } from \"./interactive\";\nimport { runJob } from \"./run-job\";\nimport { getSecrets } from \"./secrets\";\nimport { parseEnvFiles } from \"./env-file\";\nimport type { JobFunction } from \"./types\";\n\nconst BIN_NAME = \"job\";\nconst CONFIG_FILE = \"job-runner.config.ts\";\nconst DEFAULT_BUILD_COMMAND = \"turbo build\";\nconst DEFAULT_JOBS_DIRECTORY = \"dist/jobs\";\n\nconst USAGE = `Usage: ${BIN_NAME} local run <env> <job-name> [options]\n       ${BIN_NAME} cloud run <env> <job-name> [options]\n       ${BIN_NAME} cloud deploy <env>\n       ${BIN_NAME} --list\n\nCloud run options:\n  --tasks <n>         Number of parallel tasks for this execution\n  --parallelism <n>   Max concurrent tasks (sets job resource default)`;\n\nfunction validateInteger(value: number, flagName: string): number {\n  if (Number.isNaN(value) || !Number.isInteger(value) || value < 0) {\n    consola.error(\n      `Invalid value for ${flagName}: expected a non-negative integer`,\n    );\n    process.exit(1);\n  }\n  return value;\n}\n\n/**\n * Extract a numeric flag value from args.\n * Supports both `--flag N` and `--flag=N` syntax.\n * Returns undefined if the flag is not present.\n */\nfunction extractNumberFlag(\n  args: string[],\n  flagName: string,\n): number | undefined {\n  for (let i = 0; i < args.length; i++) {\n    const arg = args[i]!;\n\n    if (arg === flagName) {\n      const next = args[i + 1];\n      if (next === undefined || next.startsWith(\"-\")) {\n        consola.error(`${flagName} requires a value`);\n        process.exit(1);\n      }\n      return validateInteger(Number(next), flagName);\n    }\n\n    if (arg.startsWith(`${flagName}=`)) {\n      return validateInteger(Number(arg.slice(flagName.length + 1)), flagName);\n    }\n  }\n\n  return undefined;\n}\n\nasync function main(): Promise<void> {\n  const args = process.argv.slice(2);\n\n  /** Extract flags from anywhere in args */\n  const noBuild = args.includes(\"--no-build\");\n  const isInteractive = args.includes(\"--interactive\") || args.includes(\"-i\");\n  const isAsync = args.includes(\"--async\");\n\n  /** Determine mode early so cloud-only flags are only parsed in cloud mode */\n  const mode = args.find((arg) => !arg.startsWith(\"-\"));\n  const isCloudMode = mode === \"cloud\";\n\n  const tasks = isCloudMode ? extractNumberFlag(args, \"--tasks\") : undefined;\n  if (tasks === 0) {\n    consola.error(\"--tasks must be at least 1\");\n    process.exit(1);\n  }\n  const parallelism = isCloudMode\n    ? extractNumberFlag(args, \"--parallelism\")\n    : undefined;\n\n  const configPath = path.resolve(process.cwd(), CONFIG_FILE);\n\n  /** Load config directly (config should only depend on gcp-job-runner) */\n  let config: RunnerConfig;\n  try {\n    const module = (await import(configPath)) as { default: RunnerConfig };\n    config = module.default;\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    consola.error(\n      `Failed to load runner config from ${configPath}\\n${message}`,\n    );\n    process.exit(1);\n  }\n\n  /** Resolve jobs directory with default */\n  const jobsDirectory =\n    config.jobsDirectory ?? path.resolve(process.cwd(), DEFAULT_JOBS_DIRECTORY);\n\n  const envNames = Object.keys(config.environments);\n\n  /** Handle --list: discover and print all available jobs */\n  if (args.includes(\"--list\")) {\n    if (!noBuild && config.buildCommand !== false) {\n      const buildCommand = config.buildCommand ?? DEFAULT_BUILD_COMMAND;\n      runBuild(buildCommand);\n    }\n\n    const jobs = await discoverJobs(jobsDirectory);\n    if (jobs.length === 0) {\n      consola.info(\"No jobs found.\");\n    } else {\n      consola.info(\"Available jobs:\");\n      for (const job of jobs) {\n        consola.log(`  ${job.name}`);\n      }\n    }\n    return;\n  }\n\n  /**\n   * Parse positional arguments. In cloud mode, skip values consumed by\n   * numeric flags like `--tasks 5` so that `5` is not treated as a positional.\n   */\n  const consumedIndices = new Set<number>();\n  if (isCloudMode) {\n    for (let i = 0; i < args.length; i++) {\n      const arg = args[i]!;\n      if (\n        (arg === \"--tasks\" || arg === \"--parallelism\") &&\n        i + 1 < args.length\n      ) {\n        consumedIndices.add(i + 1);\n      }\n    }\n  }\n\n  const positionals = args.filter(\n    (arg, index) => !arg.startsWith(\"-\") && !consumedIndices.has(index),\n  );\n\n  if (mode !== \"local\" && mode !== \"cloud\") {\n    consola.error(\n      `Unknown or missing mode \"${mode ?? \"\"}\".\\n\\n` +\n        `${USAGE}\\n\\n` +\n        `Environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  const action = positionals[1];\n  if (mode === \"cloud\" && action !== \"run\" && action !== \"deploy\") {\n    consola.error(\n      `Unknown or missing action \"${action ?? \"\"}\" for cloud mode.\\n\\n` + USAGE,\n    );\n    process.exit(1);\n  }\n  if (mode === \"local\" && action !== \"run\") {\n    consola.error(\n      `Unknown or missing action \"${action ?? \"\"}\" for local mode.\\n\\n` + USAGE,\n    );\n    process.exit(1);\n  }\n\n  const envName = positionals[2];\n  if (!envName) {\n    consola.error(\n      `No environment specified.\\n\\n` +\n        `${USAGE}\\n\\n` +\n        `Environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  if (!envNames.includes(envName)) {\n    consola.error(\n      `Unknown environment \"${envName}\".\\n\\n` +\n        `Available environments: ${envNames.join(\", \")}`,\n    );\n    process.exit(1);\n  }\n\n  const envConfig = config.environments[envName]!;\n\n  /**\n   * Remaining positionals after env become the job name/path. For example\n   * `job cloud run stag test/countdown` -> positionals[3] = \"test/countdown\".\n   */\n  const jobNameFromArgs = positionals[3];\n\n  /**\n   * Collect job flags: everything after `<env>` in the original args that\n   * isn't a consumed positional or a known global flag.\n   */\n  const consumedPositionals = new Set(\n    [mode, action, envName, jobNameFromArgs].filter(Boolean),\n  );\n  const globalFlags = new Set([\n    \"--no-build\",\n    \"--interactive\",\n    \"-i\",\n    \"--async\",\n    \"--list\",\n  ]);\n\n  /** --tasks and --parallelism are cloud-only; don't strip them in local mode */\n  if (mode === \"cloud\") {\n    globalFlags.add(\"--tasks\");\n    globalFlags.add(\"--parallelism\");\n  }\n\n  const envIndex = args.indexOf(envName);\n  const jobFlags = args.slice(envIndex + 1).filter((arg, index, arr) => {\n    if (consumedPositionals.has(arg)) return false;\n    if (globalFlags.has(arg)) return false;\n    if (mode === \"cloud\") {\n      /** Filter out `--flag=value` forms of number flags */\n      if (arg.startsWith(\"--tasks=\") || arg.startsWith(\"--parallelism=\"))\n        return false;\n      /** Filter out values that follow --tasks or --parallelism */\n      const previous = arr[index - 1];\n      if (previous === \"--tasks\" || previous === \"--parallelism\") return false;\n    }\n    return true;\n  });\n\n  /** Build unless skipped */\n  if (!noBuild && config.buildCommand !== false) {\n    const buildCommand = config.buildCommand ?? DEFAULT_BUILD_COMMAND;\n    runBuild(buildCommand);\n  }\n\n  if (mode === \"local\") {\n    await handleLocalRun({\n      config,\n      envName,\n      envConfig,\n      jobsDirectory,\n      jobNameFromArgs,\n      jobFlags,\n      isInteractive,\n    });\n  } else if (action === \"deploy\") {\n    await handleCloudDeploy({ config, envConfig });\n  } else {\n    await handleCloudRun({\n      config,\n      envConfig,\n      jobsDirectory,\n      jobNameFromArgs,\n      jobFlags,\n      isInteractive,\n      isAsync,\n      tasks,\n      parallelism,\n    });\n  }\n}\n\ninterface LocalRunOptions {\n  config: RunnerConfig;\n  envName: string;\n  envConfig: RunnerConfig[\"environments\"][string];\n  jobsDirectory: string;\n  jobNameFromArgs: string | undefined;\n  jobFlags: string[];\n  isInteractive: boolean;\n}\n\nasync function handleLocalRun(options: LocalRunOptions): Promise<void> {\n  const {\n    config,\n    envName,\n    envConfig,\n    jobsDirectory,\n    jobNameFromArgs,\n    jobFlags,\n    isInteractive,\n  } = options;\n\n  /** Set environment variables for local execution */\n  process.env.NODE_ENV ??= \"development\";\n  process.env.USE_CONSOLE_LOG ??= \"true\";\n  process.env.LOG_COLORIZE ??= \"true\";\n\n  /** Load envFile variables (don't overwrite existing process.env values) */\n  const envFileVars = parseEnvFiles(envConfig.envFile);\n  for (const [key, value] of Object.entries(envFileVars)) {\n    process.env[key] ??= value;\n  }\n\n  /** Explicit env values override envFile values */\n  if (envConfig.env) {\n    for (const [key, value] of Object.entries(envConfig.env)) {\n      process.env[key] = value;\n    }\n  }\n\n  /** Project always takes highest precedence */\n  process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;\n\n  if (envConfig.secrets && envConfig.secrets.length > 0) {\n    const secrets = await getSecrets(envConfig.secrets);\n    for (const [key, value] of Object.entries(secrets)) {\n      process.env[key] = value;\n    }\n  }\n\n  if (isInteractive) {\n    const { jobArgv } = await resolveInteractiveJob(jobsDirectory);\n\n    process.argv = [process.argv[0]!, process.argv[1]!, ...jobArgv];\n\n    const commandPrefix = `${BIN_NAME} local run ${envName}`;\n\n    await runJob({\n      jobsDirectory,\n      initialize: config.initialize,\n      logger: config.logger,\n      commandPrefix,\n    });\n    return;\n  }\n\n  if (!jobNameFromArgs) {\n    consola.error(\n      `No job name specified.\\n\\n` +\n        `Usage: ${BIN_NAME} local run ${envName} <job-name> [options]\\n` +\n        `       ${BIN_NAME} local run ${envName} -i`,\n    );\n    process.exit(1);\n  }\n\n  /**\n   * Rewrite process.argv so runJob sees the job name as the first positional\n   * argument, followed by any job-specific flags.\n   */\n  process.argv = [\n    process.argv[0]!,\n    process.argv[1]!,\n    jobNameFromArgs,\n    ...jobFlags,\n  ];\n\n  const commandPrefix = `${BIN_NAME} local run ${envName}`;\n\n  await runJob({\n    jobsDirectory,\n    initialize: config.initialize,\n    logger: config.logger,\n    commandPrefix,\n  });\n}\n\ninterface CloudDeployOptions {\n  config: RunnerConfig;\n  envConfig: RunnerConfig[\"environments\"][string];\n}\n\nasync function handleCloudDeploy(options: CloudDeployOptions): Promise<void> {\n  const { config, envConfig } = options;\n  const cloud = config.cloud;\n\n  if (!cloud) {\n    consola.error(\n      \"No cloud configuration found in runner config.\\n\" +\n        \"Add a `cloud` section to your job-runner.config.ts\",\n    );\n    process.exit(1);\n  }\n\n  const serviceDirectory = process.cwd();\n\n  const { imageUri } = await prepareImage({\n    cloud,\n    envConfig,\n    serviceDirectory,\n  });\n\n  consola.info(`Image: ${imageUri}`);\n  consola.success(\"Deploy complete\");\n}\n\ninterface CloudRunOptions {\n  config: RunnerConfig;\n  envConfig: RunnerConfig[\"environments\"][string];\n  jobsDirectory: string;\n  jobNameFromArgs: string | undefined;\n  jobFlags: string[];\n  isInteractive: boolean;\n  isAsync: boolean;\n  tasks?: number;\n  parallelism?: number;\n}\n\nasync function handleCloudRun(options: CloudRunOptions): Promise<void> {\n  const {\n    config,\n    envConfig,\n    jobsDirectory,\n    jobNameFromArgs,\n    jobFlags,\n    isInteractive,\n    isAsync,\n    tasks,\n    parallelism,\n  } = options;\n\n  const cloud = config.cloud;\n\n  if (!cloud) {\n    consola.error(\n      \"No cloud configuration found in runner config.\\n\" +\n        \"Add a `cloud` section to your job-runner.config.ts\",\n    );\n    process.exit(1);\n  }\n\n  /** Override parallelism from CLI flag */\n  if (parallelism !== undefined) {\n    cloud.resources = { ...cloud.resources, parallelism };\n  }\n\n  const serviceDirectory = process.cwd();\n\n  /** Determine job name and argv */\n  let jobArgv: string[];\n\n  if (isInteractive) {\n    const result = await resolveInteractiveJob(jobsDirectory);\n    jobArgv = result.jobArgv;\n  } else {\n    if (!jobNameFromArgs) {\n      consola.error(\n        `No job name specified.\\n\\n` +\n          `Usage: ${BIN_NAME} cloud run <env> <job-name> [options]\\n` +\n          `       ${BIN_NAME} cloud run <env> -i`,\n      );\n      process.exit(1);\n    }\n    jobArgv = [jobNameFromArgs, ...jobFlags];\n  }\n\n  /** Build and push image if changed */\n  const { imageUri } = await deployIfChanged({\n    cloud,\n    envConfig,\n    serviceDirectory,\n  });\n\n  consola.info(`Image: ${imageUri}`);\n\n  /** Derive per-script Cloud Run Job name */\n  const jobScript = jobArgv[0]!;\n  const jobResourceName = deriveJobResourceName(jobScript);\n  const region = cloud.region ?? \"us-central1\";\n\n  /** Ensure per-script Cloud Run Job exists with current image */\n  await createOrUpdateJob({\n    cloud,\n    envConfig,\n    jobName: jobResourceName,\n    imageUri,\n    region,\n    project: envConfig.project,\n  });\n\n  /** Execute the per-script Cloud Run Job */\n  await execute({\n    jobResourceName,\n    region,\n    project: envConfig.project,\n    jobArgv,\n    async: isAsync,\n    tasks,\n  });\n}\n\n/**\n * Interactively select a job and prompt for arguments.\n * Returns the job name and the complete jobArgv array.\n */\nasync function resolveInteractiveJob(\n  jobsDirectory: string,\n): Promise<{ jobName: string; jobArgv: string[] }> {\n  const jobName = await selectJob(jobsDirectory);\n\n  consola.info(`Selected job: ${jobName}`);\n\n  /**\n   * Set console-friendly env vars before importing the module, since\n   * importing may initialize a structured logger like pino.\n   */\n  process.env.USE_CONSOLE_LOG ??= \"true\";\n  process.env.LOG_COLORIZE ??= \"true\";\n\n  const parts = jobName.split(\"/\");\n  const fileName = parts.pop() ?? \"\";\n  const subDirectories = parts;\n  const fileLocation = path.join(jobsDirectory, ...subDirectories);\n  const modulePath = path.resolve(fileLocation, `${fileName}.mjs`);\n\n  let schema: ZodObject<ZodRawShape> | undefined;\n  try {\n    const moduleObject = (await import(modulePath)) as Record<string, unknown>;\n    const fn = moduleObject.default as JobFunction | undefined;\n    schema = fn?.__metadata?.schema;\n  } catch {\n    /** Module might not exist yet or have errors - proceed without schema */\n  }\n\n  /** Prompt for arguments if schema exists */\n  let args: Record<string, unknown> = {};\n  if (schema && Object.keys(schema.shape).length > 0) {\n    consola.info(\"Enter arguments for the job:\");\n    args = await promptForArgs(schema);\n  }\n\n  const jobArgv = [jobName];\n  if (Object.keys(args).length > 0) {\n    jobArgv.push(\"--args\", JSON.stringify(args));\n  }\n\n  return { jobName, jobArgv };\n}\n\n/**\n * Run the build command to compile workspace dependencies.\n * Shows a spinner and hides output unless the build fails.\n */\nfunction runBuild(command: string): void {\n  consola.start(\"Building jobs source code...\");\n\n  try {\n    execSync(command, {\n      stdio: \"pipe\",\n      encoding: \"utf-8\",\n    });\n    consola.success(\"Build complete\");\n  } catch (error) {\n    consola.fail(\"Build failed\");\n\n    /** Show the build output on failure */\n    if (error && typeof error === \"object\" && \"stdout\" in error) {\n      const stdout = (error as { stdout?: string }).stdout;\n      if (stdout) {\n        consola.log(stdout);\n      }\n    }\n    if (error && typeof error === \"object\" && \"stderr\" in error) {\n      const stderr = (error as { stderr?: string }).stderr;\n      if (stderr) {\n        consola.log(stderr);\n      }\n    }\n\n    process.exit(1);\n  }\n}\n\nawait main();\n"],"mappings":";;;;;;;;;;;;;;;AAsBA,MAAM,WAAW;AACjB,MAAM,cAAc;AACpB,MAAM,wBAAwB;AAC9B,MAAM,yBAAyB;AAE/B,MAAM,QAAQ,UAAU,SAAS;SACxB,SAAS;SACT,SAAS;SACT,SAAS;;;;;AAMlB,SAAS,gBAAgB,OAAe,UAA0B;AAChE,KAAI,OAAO,MAAM,MAAM,IAAI,CAAC,OAAO,UAAU,MAAM,IAAI,QAAQ,GAAG;AAChE,UAAQ,MACN,qBAAqB,SAAS,mCAC/B;AACD,UAAQ,KAAK,EAAE;;AAEjB,QAAO;;;;;;;AAQT,SAAS,kBACP,MACA,UACoB;AACpB,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AAEjB,MAAI,QAAQ,UAAU;GACpB,MAAM,OAAO,KAAK,IAAI;AACtB,OAAI,SAAS,UAAa,KAAK,WAAW,IAAI,EAAE;AAC9C,YAAQ,MAAM,GAAG,SAAS,mBAAmB;AAC7C,YAAQ,KAAK,EAAE;;AAEjB,UAAO,gBAAgB,OAAO,KAAK,EAAE,SAAS;;AAGhD,MAAI,IAAI,WAAW,GAAG,SAAS,GAAG,CAChC,QAAO,gBAAgB,OAAO,IAAI,MAAM,SAAS,SAAS,EAAE,CAAC,EAAE,SAAS;;;AAO9E,eAAe,OAAsB;CACnC,MAAM,OAAO,QAAQ,KAAK,MAAM,EAAE;;CAGlC,MAAM,UAAU,KAAK,SAAS,aAAa;CAC3C,MAAM,gBAAgB,KAAK,SAAS,gBAAgB,IAAI,KAAK,SAAS,KAAK;CAC3E,MAAM,UAAU,KAAK,SAAS,UAAU;;CAGxC,MAAM,OAAO,KAAK,MAAM,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC;CACrD,MAAM,cAAc,SAAS;CAE7B,MAAM,QAAQ,cAAc,kBAAkB,MAAM,UAAU,GAAG;AACjE,KAAI,UAAU,GAAG;AACf,UAAQ,MAAM,6BAA6B;AAC3C,UAAQ,KAAK,EAAE;;CAEjB,MAAM,cAAc,cAChB,kBAAkB,MAAM,gBAAgB,GACxC;CAEJ,MAAM,aAAa,KAAK,QAAQ,QAAQ,KAAK,EAAE,YAAY;;CAG3D,IAAI;AACJ,KAAI;AAEF,YADgB,MAAM,OAAO,aACb;UACT,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,UAAQ,MACN,qCAAqC,WAAW,IAAI,UACrD;AACD,UAAQ,KAAK,EAAE;;;CAIjB,MAAM,gBACJ,OAAO,iBAAiB,KAAK,QAAQ,QAAQ,KAAK,EAAE,uBAAuB;CAE7E,MAAM,WAAW,OAAO,KAAK,OAAO,aAAa;;AAGjD,KAAI,KAAK,SAAS,SAAS,EAAE;AAC3B,MAAI,CAAC,WAAW,OAAO,iBAAiB,MAEtC,UADqB,OAAO,gBAAgB,sBACtB;EAGxB,MAAM,OAAO,MAAM,aAAa,cAAc;AAC9C,MAAI,KAAK,WAAW,EAClB,SAAQ,KAAK,iBAAiB;OACzB;AACL,WAAQ,KAAK,kBAAkB;AAC/B,QAAK,MAAM,OAAO,KAChB,SAAQ,IAAI,KAAK,IAAI,OAAO;;AAGhC;;;;;;CAOF,MAAM,kCAAkB,IAAI,KAAa;AACzC,KAAI,YACF,MAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EACpC,MAAM,MAAM,KAAK;AACjB,OACG,QAAQ,aAAa,QAAQ,oBAC9B,IAAI,IAAI,KAAK,OAEb,iBAAgB,IAAI,IAAI,EAAE;;CAKhC,MAAM,cAAc,KAAK,QACtB,KAAK,UAAU,CAAC,IAAI,WAAW,IAAI,IAAI,CAAC,gBAAgB,IAAI,MAAM,CACpE;AAED,KAAI,SAAS,WAAW,SAAS,SAAS;AACxC,UAAQ,MACN,4BAA4B,QAAQ,GAAG,QAClC,MAAM,oBACQ,SAAS,KAAK,KAAK,GACvC;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,SAAS,YAAY;AAC3B,KAAI,SAAS,WAAW,WAAW,SAAS,WAAW,UAAU;AAC/D,UAAQ,MACN,8BAA8B,UAAU,GAAG,yBAAyB,MACrE;AACD,UAAQ,KAAK,EAAE;;AAEjB,KAAI,SAAS,WAAW,WAAW,OAAO;AACxC,UAAQ,MACN,8BAA8B,UAAU,GAAG,yBAAyB,MACrE;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,UAAU,YAAY;AAC5B,KAAI,CAAC,SAAS;AACZ,UAAQ,MACN,gCACK,MAAM,oBACQ,SAAS,KAAK,KAAK,GACvC;AACD,UAAQ,KAAK,EAAE;;AAGjB,KAAI,CAAC,SAAS,SAAS,QAAQ,EAAE;AAC/B,UAAQ,MACN,wBAAwB,QAAQ,gCACH,SAAS,KAAK,KAAK,GACjD;AACD,UAAQ,KAAK,EAAE;;CAGjB,MAAM,YAAY,OAAO,aAAa;;;;;CAMtC,MAAM,kBAAkB,YAAY;;;;;CAMpC,MAAM,sBAAsB,IAAI,IAC9B;EAAC;EAAM;EAAQ;EAAS;EAAgB,CAAC,OAAO,QAAQ,CACzD;CACD,MAAM,cAAc,IAAI,IAAI;EAC1B;EACA;EACA;EACA;EACA;EACD,CAAC;;AAGF,KAAI,SAAS,SAAS;AACpB,cAAY,IAAI,UAAU;AAC1B,cAAY,IAAI,gBAAgB;;CAGlC,MAAM,WAAW,KAAK,QAAQ,QAAQ;CACtC,MAAM,WAAW,KAAK,MAAM,WAAW,EAAE,CAAC,QAAQ,KAAK,OAAO,QAAQ;AACpE,MAAI,oBAAoB,IAAI,IAAI,CAAE,QAAO;AACzC,MAAI,YAAY,IAAI,IAAI,CAAE,QAAO;AACjC,MAAI,SAAS,SAAS;;AAEpB,OAAI,IAAI,WAAW,WAAW,IAAI,IAAI,WAAW,iBAAiB,CAChE,QAAO;;GAET,MAAM,WAAW,IAAI,QAAQ;AAC7B,OAAI,aAAa,aAAa,aAAa,gBAAiB,QAAO;;AAErE,SAAO;GACP;;AAGF,KAAI,CAAC,WAAW,OAAO,iBAAiB,MAEtC,UADqB,OAAO,gBAAgB,sBACtB;AAGxB,KAAI,SAAS,QACX,OAAM,eAAe;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;UACO,WAAW,SACpB,OAAM,kBAAkB;EAAE;EAAQ;EAAW,CAAC;KAE9C,OAAM,eAAe;EACnB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,CAAC;;AAcN,eAAe,eAAe,SAAyC;CACrE,MAAM,EACJ,QACA,SACA,WACA,eACA,iBACA,UACA,kBACE;;AAGJ,SAAQ,IAAI,aAAa;AACzB,SAAQ,IAAI,oBAAoB;AAChC,SAAQ,IAAI,iBAAiB;;CAG7B,MAAM,cAAc,cAAc,UAAU,QAAQ;AACpD,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,YAAY,CACpD,SAAQ,IAAI,SAAS;;AAIvB,KAAI,UAAU,IACZ,MAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,IAAI,CACtD,SAAQ,IAAI,OAAO;;AAKvB,SAAQ,IAAI,uBAAuB,UAAU;AAE7C,KAAI,UAAU,WAAW,UAAU,QAAQ,SAAS,GAAG;EACrD,MAAM,UAAU,MAAM,WAAW,UAAU,QAAQ;AACnD,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,CAChD,SAAQ,IAAI,OAAO;;AAIvB,KAAI,eAAe;EACjB,MAAM,EAAE,YAAY,MAAM,sBAAsB,cAAc;AAE9D,UAAQ,OAAO;GAAC,QAAQ,KAAK;GAAK,QAAQ,KAAK;GAAK,GAAG;GAAQ;EAE/D,MAAM,gBAAgB,GAAG,SAAS,aAAa;AAE/C,QAAM,OAAO;GACX;GACA,YAAY,OAAO;GACnB,QAAQ,OAAO;GACf;GACD,CAAC;AACF;;AAGF,KAAI,CAAC,iBAAiB;AACpB,UAAQ,MACN,oCACY,SAAS,aAAa,QAAQ,gCAC9B,SAAS,aAAa,QAAQ,KAC3C;AACD,UAAQ,KAAK,EAAE;;;;;;AAOjB,SAAQ,OAAO;EACb,QAAQ,KAAK;EACb,QAAQ,KAAK;EACb;EACA,GAAG;EACJ;CAED,MAAM,gBAAgB,GAAG,SAAS,aAAa;AAE/C,OAAM,OAAO;EACX;EACA,YAAY,OAAO;EACnB,QAAQ,OAAO;EACf;EACD,CAAC;;AAQJ,eAAe,kBAAkB,SAA4C;CAC3E,MAAM,EAAE,QAAQ,cAAc;CAC9B,MAAM,QAAQ,OAAO;AAErB,KAAI,CAAC,OAAO;AACV,UAAQ,MACN,qGAED;AACD,UAAQ,KAAK,EAAE;;CAKjB,MAAM,EAAE,aAAa,MAAM,aAAa;EACtC;EACA;EACA,kBALuB,QAAQ,KAAK;EAMrC,CAAC;AAEF,SAAQ,KAAK,UAAU,WAAW;AAClC,SAAQ,QAAQ,kBAAkB;;AAepC,eAAe,eAAe,SAAyC;CACrE,MAAM,EACJ,QACA,WACA,eACA,iBACA,UACA,eACA,SACA,OACA,gBACE;CAEJ,MAAM,QAAQ,OAAO;AAErB,KAAI,CAAC,OAAO;AACV,UAAQ,MACN,qGAED;AACD,UAAQ,KAAK,EAAE;;;AAIjB,KAAI,gBAAgB,OAClB,OAAM,YAAY;EAAE,GAAG,MAAM;EAAW;EAAa;CAGvD,MAAM,mBAAmB,QAAQ,KAAK;;CAGtC,IAAI;AAEJ,KAAI,cAEF,YADe,MAAM,sBAAsB,cAAc,EACxC;MACZ;AACL,MAAI,CAAC,iBAAiB;AACpB,WAAQ,MACN,oCACY,SAAS,gDACT,SAAS,qBACtB;AACD,WAAQ,KAAK,EAAE;;AAEjB,YAAU,CAAC,iBAAiB,GAAG,SAAS;;;CAI1C,MAAM,EAAE,aAAa,MAAM,gBAAgB;EACzC;EACA;EACA;EACD,CAAC;AAEF,SAAQ,KAAK,UAAU,WAAW;;CAGlC,MAAM,YAAY,QAAQ;CAC1B,MAAM,kBAAkB,sBAAsB,UAAU;CACxD,MAAM,SAAS,MAAM,UAAU;;AAG/B,OAAM,kBAAkB;EACtB;EACA;EACA,SAAS;EACT;EACA;EACA,SAAS,UAAU;EACpB,CAAC;;AAGF,OAAM,QAAQ;EACZ;EACA;EACA,SAAS,UAAU;EACnB;EACA,OAAO;EACP;EACD,CAAC;;;;;;AAOJ,eAAe,sBACb,eACiD;CACjD,MAAM,UAAU,MAAM,UAAU,cAAc;AAE9C,SAAQ,KAAK,iBAAiB,UAAU;;;;;AAMxC,SAAQ,IAAI,oBAAoB;AAChC,SAAQ,IAAI,iBAAiB;CAE7B,MAAM,QAAQ,QAAQ,MAAM,IAAI;CAChC,MAAM,WAAW,MAAM,KAAK,IAAI;CAChC,MAAM,iBAAiB;CACvB,MAAM,eAAe,KAAK,KAAK,eAAe,GAAG,eAAe;CAChE,MAAM,aAAa,KAAK,QAAQ,cAAc,GAAG,SAAS,MAAM;CAEhE,IAAI;AACJ,KAAI;AAGF,YAFsB,MAAM,OAAO,aACX,SACX,YAAY;SACnB;;CAKR,IAAI,OAAgC,EAAE;AACtC,KAAI,UAAU,OAAO,KAAK,OAAO,MAAM,CAAC,SAAS,GAAG;AAClD,UAAQ,KAAK,+BAA+B;AAC5C,SAAO,MAAM,cAAc,OAAO;;CAGpC,MAAM,UAAU,CAAC,QAAQ;AACzB,KAAI,OAAO,KAAK,KAAK,CAAC,SAAS,EAC7B,SAAQ,KAAK,UAAU,KAAK,UAAU,KAAK,CAAC;AAG9C,QAAO;EAAE;EAAS;EAAS;;;;;;AAO7B,SAAS,SAAS,SAAuB;AACvC,SAAQ,MAAM,+BAA+B;AAE7C,KAAI;AACF,WAAS,SAAS;GAChB,OAAO;GACP,UAAU;GACX,CAAC;AACF,UAAQ,QAAQ,iBAAiB;UAC1B,OAAO;AACd,UAAQ,KAAK,eAAe;;AAG5B,MAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OAAO;GAC3D,MAAM,SAAU,MAA8B;AAC9C,OAAI,OACF,SAAQ,IAAI,OAAO;;AAGvB,MAAI,SAAS,OAAO,UAAU,YAAY,YAAY,OAAO;GAC3D,MAAM,SAAU,MAA8B;AAC9C,OAAI,OACF,SAAQ,IAAI,OAAO;;AAIvB,UAAQ,KAAK,EAAE;;;AAInB,MAAM,MAAM"}

package/dist/cloud/deploy.mjs

@@ -1,5 +1,6 @@
+import { parseEnvFiles } from "../env-file.mjs";
 import { generateDockerfile } from "./dockerfile.mjs";
-import { checkGcloudAvailable, gcloudExecCapture, gcloudJson, isDockerAvailable, shellExecCapture } from "./gcloud.mjs";
+import { checkGcloudAvailable, gcloudExecCapture, gcloudJson, isDockerDaemonRunning, isDockerInstalled, shellExecCapture, startDockerDaemon, waitForDockerDaemon } from "./gcloud.mjs";
 import { hashDirectory } from "./hash.mjs";
 import { consola } from "consola";
 import path from "node:path";
@@ -42,9 +43,38 @@ async function prepareImage(options) {
 	const project = envConfig.project;
 	let buildLocal = cloud.buildLocal !== false;
 	checkGcloudAvailable();
-	if (buildLocal && !isDockerAvailable()) {
-		consola.warn("Docker is not available, falling back to Cloud Build. Install Docker for faster local builds: https://docs.docker.com/get-docker/");
-		buildLocal = false;
+	if (buildLocal) {
+		if (!isDockerInstalled()) {
+			consola.warn("Docker is not installed, falling back to Cloud Build. Install Docker for faster local builds: https://docs.docker.com/get-docker/");
+			buildLocal = false;
+		} else if (!isDockerDaemonRunning()) if (!process.stdin.isTTY) {
+			/** Non-interactive environment (CI) — fall back automatically */
+			consola.warn("Docker daemon is not running, falling back to Cloud Build.");
+			buildLocal = false;
+		} else {
+			const choice = await consola.prompt("Docker is installed but the daemon is not running.", {
+				type: "select",
+				options: [{
+					label: "Start Docker",
+					value: "start",
+					hint: "attempt to start the daemon"
+				}, {
+					label: "Use Cloud Build",
+					value: "cloud-build",
+					hint: "build remotely instead"
+				}]
+			});
+			if (typeof choice === "symbol") process.exit(0);
+			if (choice === "start") {
+				if (!startDockerDaemon()) {
+					consola.warn("Could not start Docker automatically, falling back to Cloud Build.");
+					buildLocal = false;
+				} else if (!await waitForDockerDaemon()) {
+					consola.warn("Docker daemon did not become ready in time, falling back to Cloud Build.");
+					buildLocal = false;
+				}
+			} else buildLocal = false;
+		}
 	}
 	/** Step 1: Run isolate to bundle workspace dependencies */
 	const isolateDirectory = resolveIsolateDirectory(serviceDirectory);
@@ -176,10 +206,10 @@ async function createOrUpdateJob(options) {
 		"--region",
 		region
 	], { ignoreErrors: true });
-	/** Build environment variables */
 	const envVars = {
-		GOOGLE_CLOUD_PROJECT: project,
-		...envConfig.env
+		...parseEnvFiles(envConfig.envFile),
+		...envConfig.env,
+		GOOGLE_CLOUD_PROJECT: project
 	};
 	const envVarsString = Object.entries(envVars).map(([key, value]) => `${key}=${value}`).join(",");
 	const secretsString = (envConfig.secrets ?? []).map((name) => `${name}=${name}:latest`).join(",");
@@ -208,6 +238,11 @@ async function createOrUpdateJob(options) {
 		updateArgs.push(`--parallelism=${cloud.resources?.parallelism ?? 0}`);
 		if (secretsString) updateArgs.push(`--set-secrets=${secretsString}`);
 		if (cloud.serviceAccount) updateArgs.push(`--service-account=${cloud.serviceAccount}`);
+		if (cloud.network) {
+			updateArgs.push(`--network=${cloud.network.name}`);
+			if (cloud.network.subnet) updateArgs.push(`--subnet=${cloud.network.subnet}`);
+			updateArgs.push(`--vpc-egress=${cloud.network.egress ?? "private-ranges-only"}`);
+		}
 		const result = gcloudExecCapture(updateArgs);
 		if (!result.success) {
 			consola.error("Failed to update Cloud Run Job");
@@ -238,6 +273,11 @@ async function createOrUpdateJob(options) {
 	if (cloud.resources?.parallelism !== void 0) createArgs.push(`--parallelism=${cloud.resources.parallelism}`);
 	if (secretsString) createArgs.push(`--set-secrets=${secretsString}`);
 	if (cloud.serviceAccount) createArgs.push(`--service-account=${cloud.serviceAccount}`);
+	if (cloud.network) {
+		createArgs.push(`--network=${cloud.network.name}`);
+		if (cloud.network.subnet) createArgs.push(`--subnet=${cloud.network.subnet}`);
+		createArgs.push(`--vpc-egress=${cloud.network.egress ?? "private-ranges-only"}`);
+	}
 	const result = gcloudExecCapture(createArgs);
 	if (!result.success) {
 		consola.error("Failed to create Cloud Run Job");

package/dist/cloud/deploy.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/cloud/deploy.ts"],"sourcesContent":["import { existsSync, readFileSync, writeFileSync, unlinkSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { consola } from \"consola\";\nimport type { CloudConfig, RunnerEnvOptions } from \"../config\";\nimport { generateDockerfile } from \"./dockerfile\";\nimport {\n  checkGcloudAvailable,\n  isDockerAvailable,\n  gcloudExecCapture,\n  gcloudJson,\n  shellExecCapture,\n} from \"./gcloud\";\nimport { hashDirectory } from \"./hash\";\n\nexport interface DeployOptions {\n  /** Cloud configuration from the runner config */\n  cloud: CloudConfig;\n  /** Environment configuration (project, env vars, secrets) */\n  envConfig: RunnerEnvOptions;\n  /** Working directory (service root where isolate.config.json lives) */\n  serviceDirectory: string;\n}\n\nexport interface DeployResult {\n  /** Full image URI including tag */\n  imageUri: string;\n  /** Whether a new image was built */\n  imageBuilt: boolean;\n}\n\n/**\n * Filter out noisy gcloud hints from captured output.\n * Removes \"To execute this job\" and \"Updates are available\" blocks.\n */\nfunction filterGcloudOutput(output: string): string {\n  return output\n    .replace(/To execute this job.*?gcloud run jobs execute \\S+\\n?/gs, \"\")\n    .replace(/Updates are available.*?\\$ gcloud components update\\n?/gs, \"\")\n    .trim();\n}\n\nconst DEFAULT_REGION = \"us-central1\";\nconst DEFAULT_ARTIFACT_REGISTRY = \"cloud-run\";\nconst DEFAULT_ISOLATE_PATH = \"isolate\";\nconst GENERATED_DOCKERFILE = \"Dockerfile\";\nconst REGISTRY = \"docker.pkg.dev\";\n\ninterface IsolateConfig {\n  targetPackagePath?: string;\n}\n\n/**\n * Resolve the isolate output directory path.\n * Reads isolate.config.json if present, otherwise uses default \"./isolate\".\n */\nfunction resolveIsolateDirectory(serviceDirectory: string): string {\n  const configPath = path.join(serviceDirectory, \"isolate.config.json\");\n\n  if (existsSync(configPath)) {\n    try {\n      const configContent = readFileSync(configPath, \"utf-8\");\n      const config = JSON.parse(configContent) as IsolateConfig;\n      if (config.targetPackagePath) {\n        return path.join(serviceDirectory, config.targetPackagePath);\n      }\n    } catch {\n      /** Ignore parse errors, use default */\n    }\n  }\n\n  return path.join(serviceDirectory, DEFAULT_ISOLATE_PATH);\n}\n\nexport interface PrepareResult {\n  imageUri: string;\n  imageBuilt: boolean;\n  region: string;\n  project: string;\n}\n\n/**\n * Shared preparation logic: isolate, hash, check image, build if needed.\n * Used by both deploy() and deployIfChanged().\n */\nexport async function prepareImage(\n  options: DeployOptions,\n): Promise<PrepareResult> {\n  const { cloud, envConfig, serviceDirectory } = options;\n  const region = cloud.region ?? DEFAULT_REGION;\n  const artifactRegistry = cloud.artifactRegistry ?? DEFAULT_ARTIFACT_REGISTRY;\n  const project = envConfig.project;\n  let buildLocal = cloud.buildLocal !== false;\n\n  checkGcloudAvailable();\n\n  if (buildLocal && !isDockerAvailable()) {\n    consola.warn(\n      \"Docker is not available, falling back to Cloud Build. \" +\n        \"Install Docker for faster local builds: https://docs.docker.com/get-docker/\",\n    );\n    buildLocal = false;\n  }\n\n  /** Step 1: Run isolate to bundle workspace dependencies */\n  const isolateDirectory = resolveIsolateDirectory(serviceDirectory);\n\n  consola.start(\"Isolating package...\");\n\n  try {\n    const { isolate: runIsolate } = await import(\"isolate-package\");\n\n    const configPath = path.join(serviceDirectory, \"isolate.config.json\");\n    const fileConfig = existsSync(configPath)\n      ? JSON.parse(readFileSync(configPath, \"utf-8\"))\n      : {};\n\n    await runIsolate({\n      ...fileConfig,\n      includeDevDependencies: true,\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    consola.error(`Failed to isolate package: ${message}`);\n    process.exit(1);\n  }\n\n  consola.success(\"Package isolated\");\n\n  /** Step 2: Hash the isolate directory */\n  const tag = await hashDirectory(isolateDirectory);\n  consola.info(`Content hash: ${tag}`);\n\n  /** Step 3: Check if image already exists */\n  const imageUri = `${region}-${REGISTRY}/${project}/${artifactRegistry}/${cloud.name}:${tag}`;\n\n  const imageExists = checkImageExists(imageUri, project);\n  let imageBuilt = false;\n\n  if (imageExists) {\n    consola.success(`Image already exists: ${cloud.name}:${tag}`);\n  } else if (buildLocal) {\n    /** Step 4a: Generate Dockerfile and build locally with Docker */\n    consola.start(\"Building image locally with Docker...\");\n\n    const dockerfilePath = path.join(serviceDirectory, GENERATED_DOCKERFILE);\n    writeFileSync(dockerfilePath, generateDockerfile());\n\n    try {\n      const buildResult = shellExecCapture(\n        `docker build --platform linux/amd64 -t ${imageUri} .`,\n        { cwd: serviceDirectory },\n      );\n\n      if (!buildResult.success) {\n        consola.error(\"Docker build failed. Output:\\n\" + buildResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image built: ${cloud.name}:${tag}`);\n\n      /** Configure Docker authentication for Artifact Registry */\n      gcloudExecCapture([\n        \"auth\",\n        \"configure-docker\",\n        `${region}-${REGISTRY}`,\n        \"--quiet\",\n      ]);\n\n      consola.start(\"Pushing image to Artifact Registry...\");\n\n      const pushResult = shellExecCapture(`docker push ${imageUri}`);\n\n      if (!pushResult.success) {\n        consola.error(\"Docker push failed. Output:\\n\" + pushResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image pushed: ${cloud.name}:${tag}`);\n      imageBuilt = true;\n    } finally {\n      /** Clean up generated Dockerfile */\n      try {\n        unlinkSync(dockerfilePath);\n      } catch {\n        /** Ignore cleanup errors */\n      }\n    }\n  } else {\n    /** Step 4b: Generate Dockerfile and build with Cloud Build */\n    consola.start(\"Building image with Cloud Build...\");\n\n    const dockerfilePath = path.join(serviceDirectory, GENERATED_DOCKERFILE);\n    writeFileSync(dockerfilePath, generateDockerfile());\n\n    try {\n      const buildResult = gcloudExecCapture(\n        [\n          \"builds\",\n          \"submit\",\n          \"--project\",\n          project,\n          \"--region\",\n          region,\n          `--tag=${imageUri}`,\n          \".\",\n        ],\n        { cwd: serviceDirectory },\n      );\n\n      /** Extract and show the Cloud Build logs URL if available */\n      const logsUrlMatch = buildResult.output.match(\n        /Logs are available at \\[(.+?)]/,\n      );\n      if (logsUrlMatch) {\n        consola.info(`Cloud Build logs: ${logsUrlMatch[1]}`);\n      }\n\n      if (!buildResult.success) {\n        consola.error(\"Cloud Build failed. Output:\\n\" + buildResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image built: ${cloud.name}:${tag}`);\n      imageBuilt = true;\n    } finally {\n      /** Clean up generated Dockerfile */\n      try {\n        unlinkSync(dockerfilePath);\n      } catch {\n        /** Ignore cleanup errors */\n      }\n    }\n  }\n\n  return { imageUri, imageBuilt, region, project };\n}\n\n/**\n * Build and push a Cloud Run Job image.\n *\n * This is image-only: it does not create or update Cloud Run Job resources.\n * Use createOrUpdateJob() separately to manage job resources.\n */\nexport async function deploy(options: DeployOptions): Promise<DeployResult> {\n  const { imageUri, imageBuilt } = await prepareImage(options);\n  return { imageUri, imageBuilt };\n}\n\n/**\n * Build and push a Cloud Run Job image only if it has changed.\n *\n * This is image-only: it does not create or update Cloud Run Job resources.\n * Use createOrUpdateJob() separately to manage job resources.\n */\nexport async function deployIfChanged(\n  options: DeployOptions,\n): Promise<DeployResult> {\n  const { imageUri, imageBuilt } = await prepareImage(options);\n\n  if (!imageBuilt) {\n    consola.info(\"No changes detected, skipping image build\");\n  }\n\n  return { imageUri, imageBuilt };\n}\n\nexport interface CreateOrUpdateJobOptions {\n  cloud: CloudConfig;\n  envConfig: RunnerEnvOptions;\n  /** The Cloud Run Job resource name (e.g., \"admin-create-user\") */\n  jobName: string;\n  imageUri: string;\n  region: string;\n  project: string;\n}\n\n/**\n * Create or update a Cloud Run Job resource.\n * Returns true if the job was newly created, false if updated.\n */\nexport async function createOrUpdateJob(\n  options: CreateOrUpdateJobOptions,\n): Promise<boolean> {\n  const { cloud, envConfig, jobName, imageUri, region, project } = options;\n  const memory = cloud.resources?.memory ?? \"512Mi\";\n  const cpu = cloud.resources?.cpu ?? \"1\";\n  const timeout = cloud.resources?.timeout ?? 86400;\n\n  /** Check if job already exists */\n  const existingJob = gcloudJson(\n    [\n      \"run\",\n      \"jobs\",\n      \"describe\",\n      jobName,\n      \"--project\",\n      project,\n      \"--region\",\n      region,\n    ],\n    { ignoreErrors: true },\n  );\n\n  /** Build environment variables */\n  const envVars: Record<string, string> = {\n    GOOGLE_CLOUD_PROJECT: project,\n    ...envConfig.env,\n  };\n\n  const envVarsString = Object.entries(envVars)\n    .map(([key, value]) => `${key}=${value}`)\n    .join(\",\");\n\n  /** Build secret references */\n  const secretNames = envConfig.secrets ?? [];\n  const secretsString = secretNames\n    .map((name) => `${name}=${name}:latest`)\n    .join(\",\");\n\n  if (existingJob) {\n    consola.start(\"Updating Cloud Run Job...\");\n\n    const updateArgs = [\n      \"run\",\n      \"jobs\",\n      \"update\",\n      jobName,\n      \"--project\",\n      project,\n      \"--region\",\n      region,\n      `--image=${imageUri}`,\n      `--set-env-vars=${envVarsString}`,\n      `--memory=${memory}`,\n      `--cpu=${cpu}`,\n      `--task-timeout=${timeout}s`,\n      \"--max-retries=0\",\n    ];\n\n    /**\n     * Always pass --parallelism on update so that removing it from config\n     * resets the deployed value. Default 0 means no concurrency limit.\n     */\n    updateArgs.push(`--parallelism=${cloud.resources?.parallelism ?? 0}`);\n\n    if (secretsString) {\n      updateArgs.push(`--set-secrets=${secretsString}`);\n    }\n\n    if (cloud.serviceAccount) {\n      updateArgs.push(`--service-account=${cloud.serviceAccount}`);\n    }\n\n    const result = gcloudExecCapture(updateArgs);\n\n    if (!result.success) {\n      consola.error(\"Failed to update Cloud Run Job\");\n      process.exit(1);\n    }\n\n    const filtered = filterGcloudOutput(result.stderr);\n    if (filtered) {\n      process.stderr.write(filtered + \"\\n\");\n    }\n\n    consola.success(`Cloud Run Job updated: ${jobName}`);\n    return false;\n  }\n\n  consola.start(\"Creating Cloud Run Job...\");\n\n  const createArgs = [\n    \"run\",\n    \"jobs\",\n    \"create\",\n    jobName,\n    \"--project\",\n    project,\n    \"--region\",\n    region,\n    `--image=${imageUri}`,\n    `--set-env-vars=${envVarsString}`,\n    `--memory=${memory}`,\n    `--cpu=${cpu}`,\n    `--task-timeout=${timeout}s`,\n    \"--max-retries=0\",\n  ];\n\n  if (cloud.resources?.parallelism !== undefined) {\n    createArgs.push(`--parallelism=${cloud.resources.parallelism}`);\n  }\n\n  if (secretsString) {\n    createArgs.push(`--set-secrets=${secretsString}`);\n  }\n\n  if (cloud.serviceAccount) {\n    createArgs.push(`--service-account=${cloud.serviceAccount}`);\n  }\n\n  const result = gcloudExecCapture(createArgs);\n\n  if (!result.success) {\n    consola.error(\"Failed to create Cloud Run Job\");\n    process.exit(1);\n  }\n\n  const filtered = filterGcloudOutput(result.stderr);\n  if (filtered) {\n    process.stderr.write(filtered + \"\\n\");\n  }\n\n  consola.success(`Cloud Run Job created: ${jobName}`);\n  return true;\n}\n\n/**\n * Check if a Docker image exists in Artifact Registry.\n */\nfunction checkImageExists(imageUri: string, project: string): boolean {\n  const result = gcloudJson(\n    [\n      \"artifacts\",\n      \"docker\",\n      \"images\",\n      \"describe\",\n      imageUri,\n      \"--project\",\n      project,\n    ],\n    { ignoreErrors: true },\n  );\n\n  return result !== undefined;\n}\n"],"mappings":";;;;;;;;;;;;AAkCA,SAAS,mBAAmB,QAAwB;AAClD,QAAO,OACJ,QAAQ,0DAA0D,GAAG,CACrE,QAAQ,4DAA4D,GAAG,CACvE,MAAM;;AAGX,MAAM,iBAAiB;AACvB,MAAM,4BAA4B;AAClC,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAC7B,MAAM,WAAW;;;;;AAUjB,SAAS,wBAAwB,kBAAkC;CACjE,MAAM,aAAa,KAAK,KAAK,kBAAkB,sBAAsB;AAErE,KAAI,WAAW,WAAW,CACxB,KAAI;EACF,MAAM,gBAAgB,aAAa,YAAY,QAAQ;EACvD,MAAM,SAAS,KAAK,MAAM,cAAc;AACxC,MAAI,OAAO,kBACT,QAAO,KAAK,KAAK,kBAAkB,OAAO,kBAAkB;SAExD;AAKV,QAAO,KAAK,KAAK,kBAAkB,qBAAqB;;;;;;AAc1D,eAAsB,aACpB,SACwB;CACxB,MAAM,EAAE,OAAO,WAAW,qBAAqB;CAC/C,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,mBAAmB,MAAM,oBAAoB;CACnD,MAAM,UAAU,UAAU;CAC1B,IAAI,aAAa,MAAM,eAAe;AAEtC,uBAAsB;AAEtB,KAAI,cAAc,CAAC,mBAAmB,EAAE;AACtC,UAAQ,KACN,oIAED;AACD,eAAa;;;CAIf,MAAM,mBAAmB,wBAAwB,iBAAiB;AAElE,SAAQ,MAAM,uBAAuB;AAErC,KAAI;EACF,MAAM,EAAE,SAAS,eAAe,MAAM,OAAO;EAE7C,MAAM,aAAa,KAAK,KAAK,kBAAkB,sBAAsB;AAKrE,QAAM,WAAW;GACf,GALiB,WAAW,WAAW,GACrC,KAAK,MAAM,aAAa,YAAY,QAAQ,CAAC,GAC7C,EAAE;GAIJ,wBAAwB;GACzB,CAAC;UACK,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,UAAQ,MAAM,8BAA8B,UAAU;AACtD,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,QAAQ,mBAAmB;;CAGnC,MAAM,MAAM,MAAM,cAAc,iBAAiB;AACjD,SAAQ,KAAK,iBAAiB,MAAM;;CAGpC,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,MAAM,KAAK,GAAG;CAEvF,MAAM,cAAc,iBAAiB,UAAU,QAAQ;CACvD,IAAI,aAAa;AAEjB,KAAI,YACF,SAAQ,QAAQ,yBAAyB,MAAM,KAAK,GAAG,MAAM;UACpD,YAAY;;AAErB,UAAQ,MAAM,wCAAwC;EAEtD,MAAM,iBAAiB,KAAK,KAAK,kBAAkB,qBAAqB;AACxE,gBAAc,gBAAgB,oBAAoB,CAAC;AAEnD,MAAI;GACF,MAAM,cAAc,iBAClB,0CAA0C,SAAS,KACnD,EAAE,KAAK,kBAAkB,CAC1B;AAED,OAAI,CAAC,YAAY,SAAS;AACxB,YAAQ,MAAM,mCAAmC,YAAY,OAAO;AACpE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,gBAAgB,MAAM,KAAK,GAAG,MAAM;;AAGpD,qBAAkB;IAChB;IACA;IACA,GAAG,OAAO,GAAG;IACb;IACD,CAAC;AAEF,WAAQ,MAAM,wCAAwC;GAEtD,MAAM,aAAa,iBAAiB,eAAe,WAAW;AAE9D,OAAI,CAAC,WAAW,SAAS;AACvB,YAAQ,MAAM,kCAAkC,WAAW,OAAO;AAClE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,iBAAiB,MAAM,KAAK,GAAG,MAAM;AACrD,gBAAa;YACL;;AAER,OAAI;AACF,eAAW,eAAe;WACpB;;QAIL;;AAEL,UAAQ,MAAM,qCAAqC;EAEnD,MAAM,iBAAiB,KAAK,KAAK,kBAAkB,qBAAqB;AACxE,gBAAc,gBAAgB,oBAAoB,CAAC;AAEnD,MAAI;GACF,MAAM,cAAc,kBAClB;IACE;IACA;IACA;IACA;IACA;IACA;IACA,SAAS;IACT;IACD,EACD,EAAE,KAAK,kBAAkB,CAC1B;;GAGD,MAAM,eAAe,YAAY,OAAO,MACtC,iCACD;AACD,OAAI,aACF,SAAQ,KAAK,qBAAqB,aAAa,KAAK;AAGtD,OAAI,CAAC,YAAY,SAAS;AACxB,YAAQ,MAAM,kCAAkC,YAAY,OAAO;AACnE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,gBAAgB,MAAM,KAAK,GAAG,MAAM;AACpD,gBAAa;YACL;;AAER,OAAI;AACF,eAAW,eAAe;WACpB;;;AAMZ,QAAO;EAAE;EAAU;EAAY;EAAQ;EAAS;;;;;;;;AAoBlD,eAAsB,gBACpB,SACuB;CACvB,MAAM,EAAE,UAAU,eAAe,MAAM,aAAa,QAAQ;AAE5D,KAAI,CAAC,WACH,SAAQ,KAAK,4CAA4C;AAG3D,QAAO;EAAE;EAAU;EAAY;;;;;;AAiBjC,eAAsB,kBACpB,SACkB;CAClB,MAAM,EAAE,OAAO,WAAW,SAAS,UAAU,QAAQ,YAAY;CACjE,MAAM,SAAS,MAAM,WAAW,UAAU;CAC1C,MAAM,MAAM,MAAM,WAAW,OAAO;CACpC,MAAM,UAAU,MAAM,WAAW,WAAW;;CAG5C,MAAM,cAAc,WAClB;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,EACD,EAAE,cAAc,MAAM,CACvB;;CAGD,MAAM,UAAkC;EACtC,sBAAsB;EACtB,GAAG,UAAU;EACd;CAED,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,CAC1C,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,QAAQ,CACxC,KAAK,IAAI;CAIZ,MAAM,iBADc,UAAU,WAAW,EAAE,EAExC,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,SAAS,CACvC,KAAK,IAAI;AAEZ,KAAI,aAAa;AACf,UAAQ,MAAM,4BAA4B;EAE1C,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,WAAW;GACX,kBAAkB;GAClB,YAAY;GACZ,SAAS;GACT,kBAAkB,QAAQ;GAC1B;GACD;;;;;AAMD,aAAW,KAAK,iBAAiB,MAAM,WAAW,eAAe,IAAI;AAErE,MAAI,cACF,YAAW,KAAK,iBAAiB,gBAAgB;AAGnD,MAAI,MAAM,eACR,YAAW,KAAK,qBAAqB,MAAM,iBAAiB;EAG9D,MAAM,SAAS,kBAAkB,WAAW;AAE5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAQ,MAAM,iCAAiC;AAC/C,WAAQ,KAAK,EAAE;;EAGjB,MAAM,WAAW,mBAAmB,OAAO,OAAO;AAClD,MAAI,SACF,SAAQ,OAAO,MAAM,WAAW,KAAK;AAGvC,UAAQ,QAAQ,0BAA0B,UAAU;AACpD,SAAO;;AAGT,SAAQ,MAAM,4BAA4B;CAE1C,MAAM,aAAa;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,kBAAkB;EAClB,YAAY;EACZ,SAAS;EACT,kBAAkB,QAAQ;EAC1B;EACD;AAED,KAAI,MAAM,WAAW,gBAAgB,OACnC,YAAW,KAAK,iBAAiB,MAAM,UAAU,cAAc;AAGjE,KAAI,cACF,YAAW,KAAK,iBAAiB,gBAAgB;AAGnD,KAAI,MAAM,eACR,YAAW,KAAK,qBAAqB,MAAM,iBAAiB;CAG9D,MAAM,SAAS,kBAAkB,WAAW;AAE5C,KAAI,CAAC,OAAO,SAAS;AACnB,UAAQ,MAAM,iCAAiC;AAC/C,UAAQ,KAAK,EAAE;;CAGjB,MAAM,WAAW,mBAAmB,OAAO,OAAO;AAClD,KAAI,SACF,SAAQ,OAAO,MAAM,WAAW,KAAK;AAGvC,SAAQ,QAAQ,0BAA0B,UAAU;AACpD,QAAO;;;;;AAMT,SAAS,iBAAiB,UAAkB,SAA0B;AAcpE,QAbe,WACb;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACD,EACD,EAAE,cAAc,MAAM,CACvB,KAEiB"}
+{"version":3,"file":"deploy.mjs","names":[],"sources":["../../src/cloud/deploy.ts"],"sourcesContent":["import { existsSync, readFileSync, writeFileSync, unlinkSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { consola } from \"consola\";\nimport type { CloudConfig, RunnerEnvOptions } from \"../config\";\nimport { parseEnvFiles } from \"../env-file\";\nimport { generateDockerfile } from \"./dockerfile\";\nimport {\n  checkGcloudAvailable,\n  isDockerInstalled,\n  isDockerDaemonRunning,\n  startDockerDaemon,\n  waitForDockerDaemon,\n  gcloudExecCapture,\n  gcloudJson,\n  shellExecCapture,\n} from \"./gcloud\";\nimport { hashDirectory } from \"./hash\";\n\nexport interface DeployOptions {\n  /** Cloud configuration from the runner config */\n  cloud: CloudConfig;\n  /** Environment configuration (project, env vars, secrets) */\n  envConfig: RunnerEnvOptions;\n  /** Working directory (service root where isolate.config.json lives) */\n  serviceDirectory: string;\n}\n\nexport interface DeployResult {\n  /** Full image URI including tag */\n  imageUri: string;\n  /** Whether a new image was built */\n  imageBuilt: boolean;\n}\n\n/**\n * Filter out noisy gcloud hints from captured output.\n * Removes \"To execute this job\" and \"Updates are available\" blocks.\n */\nfunction filterGcloudOutput(output: string): string {\n  return output\n    .replace(/To execute this job.*?gcloud run jobs execute \\S+\\n?/gs, \"\")\n    .replace(/Updates are available.*?\\$ gcloud components update\\n?/gs, \"\")\n    .trim();\n}\n\nconst DEFAULT_REGION = \"us-central1\";\nconst DEFAULT_ARTIFACT_REGISTRY = \"cloud-run\";\nconst DEFAULT_ISOLATE_PATH = \"isolate\";\nconst GENERATED_DOCKERFILE = \"Dockerfile\";\nconst REGISTRY = \"docker.pkg.dev\";\n\ninterface IsolateConfig {\n  targetPackagePath?: string;\n}\n\n/**\n * Resolve the isolate output directory path.\n * Reads isolate.config.json if present, otherwise uses default \"./isolate\".\n */\nfunction resolveIsolateDirectory(serviceDirectory: string): string {\n  const configPath = path.join(serviceDirectory, \"isolate.config.json\");\n\n  if (existsSync(configPath)) {\n    try {\n      const configContent = readFileSync(configPath, \"utf-8\");\n      const config = JSON.parse(configContent) as IsolateConfig;\n      if (config.targetPackagePath) {\n        return path.join(serviceDirectory, config.targetPackagePath);\n      }\n    } catch {\n      /** Ignore parse errors, use default */\n    }\n  }\n\n  return path.join(serviceDirectory, DEFAULT_ISOLATE_PATH);\n}\n\nexport interface PrepareResult {\n  imageUri: string;\n  imageBuilt: boolean;\n  region: string;\n  project: string;\n}\n\n/**\n * Shared preparation logic: isolate, hash, check image, build if needed.\n * Used by both deploy() and deployIfChanged().\n */\nexport async function prepareImage(\n  options: DeployOptions,\n): Promise<PrepareResult> {\n  const { cloud, envConfig, serviceDirectory } = options;\n  const region = cloud.region ?? DEFAULT_REGION;\n  const artifactRegistry = cloud.artifactRegistry ?? DEFAULT_ARTIFACT_REGISTRY;\n  const project = envConfig.project;\n  let buildLocal = cloud.buildLocal !== false;\n\n  checkGcloudAvailable();\n\n  if (buildLocal) {\n    if (!isDockerInstalled()) {\n      consola.warn(\n        \"Docker is not installed, falling back to Cloud Build. \" +\n          \"Install Docker for faster local builds: https://docs.docker.com/get-docker/\",\n      );\n      buildLocal = false;\n    } else if (!isDockerDaemonRunning()) {\n      if (!process.stdin.isTTY) {\n        /** Non-interactive environment (CI) — fall back automatically */\n        consola.warn(\n          \"Docker daemon is not running, falling back to Cloud Build.\",\n        );\n        buildLocal = false;\n      } else {\n        const choice = await consola.prompt(\n          \"Docker is installed but the daemon is not running.\",\n          {\n            type: \"select\",\n            options: [\n              {\n                label: \"Start Docker\",\n                value: \"start\",\n                hint: \"attempt to start the daemon\",\n              },\n              {\n                label: \"Use Cloud Build\",\n                value: \"cloud-build\",\n                hint: \"build remotely instead\",\n              },\n            ],\n          },\n        );\n\n        if (typeof choice === \"symbol\") {\n          process.exit(0);\n        }\n\n        if (choice === \"start\") {\n          const started = startDockerDaemon();\n\n          if (!started) {\n            consola.warn(\n              \"Could not start Docker automatically, falling back to Cloud Build.\",\n            );\n            buildLocal = false;\n          } else {\n            const ready = await waitForDockerDaemon();\n\n            if (!ready) {\n              consola.warn(\n                \"Docker daemon did not become ready in time, falling back to Cloud Build.\",\n              );\n              buildLocal = false;\n            }\n          }\n        } else {\n          buildLocal = false;\n        }\n      }\n    }\n  }\n\n  /** Step 1: Run isolate to bundle workspace dependencies */\n  const isolateDirectory = resolveIsolateDirectory(serviceDirectory);\n\n  consola.start(\"Isolating package...\");\n\n  try {\n    const { isolate: runIsolate } = await import(\"isolate-package\");\n\n    const configPath = path.join(serviceDirectory, \"isolate.config.json\");\n    const fileConfig = existsSync(configPath)\n      ? JSON.parse(readFileSync(configPath, \"utf-8\"))\n      : {};\n\n    await runIsolate({\n      ...fileConfig,\n      includeDevDependencies: true,\n    });\n  } catch (error) {\n    const message = error instanceof Error ? error.message : String(error);\n    consola.error(`Failed to isolate package: ${message}`);\n    process.exit(1);\n  }\n\n  consola.success(\"Package isolated\");\n\n  /** Step 2: Hash the isolate directory */\n  const tag = await hashDirectory(isolateDirectory);\n  consola.info(`Content hash: ${tag}`);\n\n  /** Step 3: Check if image already exists */\n  const imageUri = `${region}-${REGISTRY}/${project}/${artifactRegistry}/${cloud.name}:${tag}`;\n\n  const imageExists = checkImageExists(imageUri, project);\n  let imageBuilt = false;\n\n  if (imageExists) {\n    consola.success(`Image already exists: ${cloud.name}:${tag}`);\n  } else if (buildLocal) {\n    /** Step 4a: Generate Dockerfile and build locally with Docker */\n    consola.start(\"Building image locally with Docker...\");\n\n    const dockerfilePath = path.join(serviceDirectory, GENERATED_DOCKERFILE);\n    writeFileSync(dockerfilePath, generateDockerfile());\n\n    try {\n      const buildResult = shellExecCapture(\n        `docker build --platform linux/amd64 -t ${imageUri} .`,\n        { cwd: serviceDirectory },\n      );\n\n      if (!buildResult.success) {\n        consola.error(\"Docker build failed. Output:\\n\" + buildResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image built: ${cloud.name}:${tag}`);\n\n      /** Configure Docker authentication for Artifact Registry */\n      gcloudExecCapture([\n        \"auth\",\n        \"configure-docker\",\n        `${region}-${REGISTRY}`,\n        \"--quiet\",\n      ]);\n\n      consola.start(\"Pushing image to Artifact Registry...\");\n\n      const pushResult = shellExecCapture(`docker push ${imageUri}`);\n\n      if (!pushResult.success) {\n        consola.error(\"Docker push failed. Output:\\n\" + pushResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image pushed: ${cloud.name}:${tag}`);\n      imageBuilt = true;\n    } finally {\n      /** Clean up generated Dockerfile */\n      try {\n        unlinkSync(dockerfilePath);\n      } catch {\n        /** Ignore cleanup errors */\n      }\n    }\n  } else {\n    /** Step 4b: Generate Dockerfile and build with Cloud Build */\n    consola.start(\"Building image with Cloud Build...\");\n\n    const dockerfilePath = path.join(serviceDirectory, GENERATED_DOCKERFILE);\n    writeFileSync(dockerfilePath, generateDockerfile());\n\n    try {\n      const buildResult = gcloudExecCapture(\n        [\n          \"builds\",\n          \"submit\",\n          \"--project\",\n          project,\n          \"--region\",\n          region,\n          `--tag=${imageUri}`,\n          \".\",\n        ],\n        { cwd: serviceDirectory },\n      );\n\n      /** Extract and show the Cloud Build logs URL if available */\n      const logsUrlMatch = buildResult.output.match(\n        /Logs are available at \\[(.+?)]/,\n      );\n      if (logsUrlMatch) {\n        consola.info(`Cloud Build logs: ${logsUrlMatch[1]}`);\n      }\n\n      if (!buildResult.success) {\n        consola.error(\"Cloud Build failed. Output:\\n\" + buildResult.output);\n        process.exit(1);\n      }\n\n      consola.success(`Image built: ${cloud.name}:${tag}`);\n      imageBuilt = true;\n    } finally {\n      /** Clean up generated Dockerfile */\n      try {\n        unlinkSync(dockerfilePath);\n      } catch {\n        /** Ignore cleanup errors */\n      }\n    }\n  }\n\n  return { imageUri, imageBuilt, region, project };\n}\n\n/**\n * Build and push a Cloud Run Job image.\n *\n * This is image-only: it does not create or update Cloud Run Job resources.\n * Use createOrUpdateJob() separately to manage job resources.\n */\nexport async function deploy(options: DeployOptions): Promise<DeployResult> {\n  const { imageUri, imageBuilt } = await prepareImage(options);\n  return { imageUri, imageBuilt };\n}\n\n/**\n * Build and push a Cloud Run Job image only if it has changed.\n *\n * This is image-only: it does not create or update Cloud Run Job resources.\n * Use createOrUpdateJob() separately to manage job resources.\n */\nexport async function deployIfChanged(\n  options: DeployOptions,\n): Promise<DeployResult> {\n  const { imageUri, imageBuilt } = await prepareImage(options);\n\n  if (!imageBuilt) {\n    consola.info(\"No changes detected, skipping image build\");\n  }\n\n  return { imageUri, imageBuilt };\n}\n\nexport interface CreateOrUpdateJobOptions {\n  cloud: CloudConfig;\n  envConfig: RunnerEnvOptions;\n  /** The Cloud Run Job resource name (e.g., \"admin-create-user\") */\n  jobName: string;\n  imageUri: string;\n  region: string;\n  project: string;\n}\n\n/**\n * Create or update a Cloud Run Job resource.\n * Returns true if the job was newly created, false if updated.\n */\nexport async function createOrUpdateJob(\n  options: CreateOrUpdateJobOptions,\n): Promise<boolean> {\n  const { cloud, envConfig, jobName, imageUri, region, project } = options;\n  const memory = cloud.resources?.memory ?? \"512Mi\";\n  const cpu = cloud.resources?.cpu ?? \"1\";\n  const timeout = cloud.resources?.timeout ?? 86400;\n\n  /** Check if job already exists */\n  const existingJob = gcloudJson(\n    [\n      \"run\",\n      \"jobs\",\n      \"describe\",\n      jobName,\n      \"--project\",\n      project,\n      \"--region\",\n      region,\n    ],\n    { ignoreErrors: true },\n  );\n\n  /** Build environment variables (envFile < env < project) */\n  const envFileVars = parseEnvFiles(envConfig.envFile);\n  const envVars: Record<string, string> = {\n    ...envFileVars,\n    ...envConfig.env,\n    GOOGLE_CLOUD_PROJECT: project,\n  };\n\n  const envVarsString = Object.entries(envVars)\n    .map(([key, value]) => `${key}=${value}`)\n    .join(\",\");\n\n  /** Build secret references */\n  const secretNames = envConfig.secrets ?? [];\n  const secretsString = secretNames\n    .map((name) => `${name}=${name}:latest`)\n    .join(\",\");\n\n  if (existingJob) {\n    consola.start(\"Updating Cloud Run Job...\");\n\n    const updateArgs = [\n      \"run\",\n      \"jobs\",\n      \"update\",\n      jobName,\n      \"--project\",\n      project,\n      \"--region\",\n      region,\n      `--image=${imageUri}`,\n      `--set-env-vars=${envVarsString}`,\n      `--memory=${memory}`,\n      `--cpu=${cpu}`,\n      `--task-timeout=${timeout}s`,\n      \"--max-retries=0\",\n    ];\n\n    /**\n     * Always pass --parallelism on update so that removing it from config\n     * resets the deployed value. Default 0 means no concurrency limit.\n     */\n    updateArgs.push(`--parallelism=${cloud.resources?.parallelism ?? 0}`);\n\n    if (secretsString) {\n      updateArgs.push(`--set-secrets=${secretsString}`);\n    }\n\n    if (cloud.serviceAccount) {\n      updateArgs.push(`--service-account=${cloud.serviceAccount}`);\n    }\n\n    if (cloud.network) {\n      updateArgs.push(`--network=${cloud.network.name}`);\n      if (cloud.network.subnet) {\n        updateArgs.push(`--subnet=${cloud.network.subnet}`);\n      }\n      updateArgs.push(\n        `--vpc-egress=${cloud.network.egress ?? \"private-ranges-only\"}`,\n      );\n    }\n\n    const result = gcloudExecCapture(updateArgs);\n\n    if (!result.success) {\n      consola.error(\"Failed to update Cloud Run Job\");\n      process.exit(1);\n    }\n\n    const filtered = filterGcloudOutput(result.stderr);\n    if (filtered) {\n      process.stderr.write(filtered + \"\\n\");\n    }\n\n    consola.success(`Cloud Run Job updated: ${jobName}`);\n    return false;\n  }\n\n  consola.start(\"Creating Cloud Run Job...\");\n\n  const createArgs = [\n    \"run\",\n    \"jobs\",\n    \"create\",\n    jobName,\n    \"--project\",\n    project,\n    \"--region\",\n    region,\n    `--image=${imageUri}`,\n    `--set-env-vars=${envVarsString}`,\n    `--memory=${memory}`,\n    `--cpu=${cpu}`,\n    `--task-timeout=${timeout}s`,\n    \"--max-retries=0\",\n  ];\n\n  if (cloud.resources?.parallelism !== undefined) {\n    createArgs.push(`--parallelism=${cloud.resources.parallelism}`);\n  }\n\n  if (secretsString) {\n    createArgs.push(`--set-secrets=${secretsString}`);\n  }\n\n  if (cloud.serviceAccount) {\n    createArgs.push(`--service-account=${cloud.serviceAccount}`);\n  }\n\n  if (cloud.network) {\n    createArgs.push(`--network=${cloud.network.name}`);\n    if (cloud.network.subnet) {\n      createArgs.push(`--subnet=${cloud.network.subnet}`);\n    }\n    createArgs.push(\n      `--vpc-egress=${cloud.network.egress ?? \"private-ranges-only\"}`,\n    );\n  }\n\n  const result = gcloudExecCapture(createArgs);\n\n  if (!result.success) {\n    consola.error(\"Failed to create Cloud Run Job\");\n    process.exit(1);\n  }\n\n  const filtered = filterGcloudOutput(result.stderr);\n  if (filtered) {\n    process.stderr.write(filtered + \"\\n\");\n  }\n\n  consola.success(`Cloud Run Job created: ${jobName}`);\n  return true;\n}\n\n/**\n * Check if a Docker image exists in Artifact Registry.\n */\nfunction checkImageExists(imageUri: string, project: string): boolean {\n  const result = gcloudJson(\n    [\n      \"artifacts\",\n      \"docker\",\n      \"images\",\n      \"describe\",\n      imageUri,\n      \"--project\",\n      project,\n    ],\n    { ignoreErrors: true },\n  );\n\n  return result !== undefined;\n}\n"],"mappings":";;;;;;;;;;;;;AAsCA,SAAS,mBAAmB,QAAwB;AAClD,QAAO,OACJ,QAAQ,0DAA0D,GAAG,CACrE,QAAQ,4DAA4D,GAAG,CACvE,MAAM;;AAGX,MAAM,iBAAiB;AACvB,MAAM,4BAA4B;AAClC,MAAM,uBAAuB;AAC7B,MAAM,uBAAuB;AAC7B,MAAM,WAAW;;;;;AAUjB,SAAS,wBAAwB,kBAAkC;CACjE,MAAM,aAAa,KAAK,KAAK,kBAAkB,sBAAsB;AAErE,KAAI,WAAW,WAAW,CACxB,KAAI;EACF,MAAM,gBAAgB,aAAa,YAAY,QAAQ;EACvD,MAAM,SAAS,KAAK,MAAM,cAAc;AACxC,MAAI,OAAO,kBACT,QAAO,KAAK,KAAK,kBAAkB,OAAO,kBAAkB;SAExD;AAKV,QAAO,KAAK,KAAK,kBAAkB,qBAAqB;;;;;;AAc1D,eAAsB,aACpB,SACwB;CACxB,MAAM,EAAE,OAAO,WAAW,qBAAqB;CAC/C,MAAM,SAAS,MAAM,UAAU;CAC/B,MAAM,mBAAmB,MAAM,oBAAoB;CACnD,MAAM,UAAU,UAAU;CAC1B,IAAI,aAAa,MAAM,eAAe;AAEtC,uBAAsB;AAEtB,KAAI,YACF;MAAI,CAAC,mBAAmB,EAAE;AACxB,WAAQ,KACN,oIAED;AACD,gBAAa;aACJ,CAAC,uBAAuB,CACjC,KAAI,CAAC,QAAQ,MAAM,OAAO;;AAExB,WAAQ,KACN,6DACD;AACD,gBAAa;SACR;GACL,MAAM,SAAS,MAAM,QAAQ,OAC3B,sDACA;IACE,MAAM;IACN,SAAS,CACP;KACE,OAAO;KACP,OAAO;KACP,MAAM;KACP,EACD;KACE,OAAO;KACP,OAAO;KACP,MAAM;KACP,CACF;IACF,CACF;AAED,OAAI,OAAO,WAAW,SACpB,SAAQ,KAAK,EAAE;AAGjB,OAAI,WAAW,SAGb;QAAI,CAFY,mBAAmB,EAErB;AACZ,aAAQ,KACN,qEACD;AACD,kBAAa;eAIT,CAFU,MAAM,qBAAqB,EAE7B;AACV,aAAQ,KACN,2EACD;AACD,kBAAa;;SAIjB,cAAa;;;;CAOrB,MAAM,mBAAmB,wBAAwB,iBAAiB;AAElE,SAAQ,MAAM,uBAAuB;AAErC,KAAI;EACF,MAAM,EAAE,SAAS,eAAe,MAAM,OAAO;EAE7C,MAAM,aAAa,KAAK,KAAK,kBAAkB,sBAAsB;AAKrE,QAAM,WAAW;GACf,GALiB,WAAW,WAAW,GACrC,KAAK,MAAM,aAAa,YAAY,QAAQ,CAAC,GAC7C,EAAE;GAIJ,wBAAwB;GACzB,CAAC;UACK,OAAO;EACd,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,UAAQ,MAAM,8BAA8B,UAAU;AACtD,UAAQ,KAAK,EAAE;;AAGjB,SAAQ,QAAQ,mBAAmB;;CAGnC,MAAM,MAAM,MAAM,cAAc,iBAAiB;AACjD,SAAQ,KAAK,iBAAiB,MAAM;;CAGpC,MAAM,WAAW,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,iBAAiB,GAAG,MAAM,KAAK,GAAG;CAEvF,MAAM,cAAc,iBAAiB,UAAU,QAAQ;CACvD,IAAI,aAAa;AAEjB,KAAI,YACF,SAAQ,QAAQ,yBAAyB,MAAM,KAAK,GAAG,MAAM;UACpD,YAAY;;AAErB,UAAQ,MAAM,wCAAwC;EAEtD,MAAM,iBAAiB,KAAK,KAAK,kBAAkB,qBAAqB;AACxE,gBAAc,gBAAgB,oBAAoB,CAAC;AAEnD,MAAI;GACF,MAAM,cAAc,iBAClB,0CAA0C,SAAS,KACnD,EAAE,KAAK,kBAAkB,CAC1B;AAED,OAAI,CAAC,YAAY,SAAS;AACxB,YAAQ,MAAM,mCAAmC,YAAY,OAAO;AACpE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,gBAAgB,MAAM,KAAK,GAAG,MAAM;;AAGpD,qBAAkB;IAChB;IACA;IACA,GAAG,OAAO,GAAG;IACb;IACD,CAAC;AAEF,WAAQ,MAAM,wCAAwC;GAEtD,MAAM,aAAa,iBAAiB,eAAe,WAAW;AAE9D,OAAI,CAAC,WAAW,SAAS;AACvB,YAAQ,MAAM,kCAAkC,WAAW,OAAO;AAClE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,iBAAiB,MAAM,KAAK,GAAG,MAAM;AACrD,gBAAa;YACL;;AAER,OAAI;AACF,eAAW,eAAe;WACpB;;QAIL;;AAEL,UAAQ,MAAM,qCAAqC;EAEnD,MAAM,iBAAiB,KAAK,KAAK,kBAAkB,qBAAqB;AACxE,gBAAc,gBAAgB,oBAAoB,CAAC;AAEnD,MAAI;GACF,MAAM,cAAc,kBAClB;IACE;IACA;IACA;IACA;IACA;IACA;IACA,SAAS;IACT;IACD,EACD,EAAE,KAAK,kBAAkB,CAC1B;;GAGD,MAAM,eAAe,YAAY,OAAO,MACtC,iCACD;AACD,OAAI,aACF,SAAQ,KAAK,qBAAqB,aAAa,KAAK;AAGtD,OAAI,CAAC,YAAY,SAAS;AACxB,YAAQ,MAAM,kCAAkC,YAAY,OAAO;AACnE,YAAQ,KAAK,EAAE;;AAGjB,WAAQ,QAAQ,gBAAgB,MAAM,KAAK,GAAG,MAAM;AACpD,gBAAa;YACL;;AAER,OAAI;AACF,eAAW,eAAe;WACpB;;;AAMZ,QAAO;EAAE;EAAU;EAAY;EAAQ;EAAS;;;;;;;;AAoBlD,eAAsB,gBACpB,SACuB;CACvB,MAAM,EAAE,UAAU,eAAe,MAAM,aAAa,QAAQ;AAE5D,KAAI,CAAC,WACH,SAAQ,KAAK,4CAA4C;AAG3D,QAAO;EAAE;EAAU;EAAY;;;;;;AAiBjC,eAAsB,kBACpB,SACkB;CAClB,MAAM,EAAE,OAAO,WAAW,SAAS,UAAU,QAAQ,YAAY;CACjE,MAAM,SAAS,MAAM,WAAW,UAAU;CAC1C,MAAM,MAAM,MAAM,WAAW,OAAO;CACpC,MAAM,UAAU,MAAM,WAAW,WAAW;;CAG5C,MAAM,cAAc,WAClB;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACD,EACD,EAAE,cAAc,MAAM,CACvB;CAID,MAAM,UAAkC;EACtC,GAFkB,cAAc,UAAU,QAAQ;EAGlD,GAAG,UAAU;EACb,sBAAsB;EACvB;CAED,MAAM,gBAAgB,OAAO,QAAQ,QAAQ,CAC1C,KAAK,CAAC,KAAK,WAAW,GAAG,IAAI,GAAG,QAAQ,CACxC,KAAK,IAAI;CAIZ,MAAM,iBADc,UAAU,WAAW,EAAE,EAExC,KAAK,SAAS,GAAG,KAAK,GAAG,KAAK,SAAS,CACvC,KAAK,IAAI;AAEZ,KAAI,aAAa;AACf,UAAQ,MAAM,4BAA4B;EAE1C,MAAM,aAAa;GACjB;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA,WAAW;GACX,kBAAkB;GAClB,YAAY;GACZ,SAAS;GACT,kBAAkB,QAAQ;GAC1B;GACD;;;;;AAMD,aAAW,KAAK,iBAAiB,MAAM,WAAW,eAAe,IAAI;AAErE,MAAI,cACF,YAAW,KAAK,iBAAiB,gBAAgB;AAGnD,MAAI,MAAM,eACR,YAAW,KAAK,qBAAqB,MAAM,iBAAiB;AAG9D,MAAI,MAAM,SAAS;AACjB,cAAW,KAAK,aAAa,MAAM,QAAQ,OAAO;AAClD,OAAI,MAAM,QAAQ,OAChB,YAAW,KAAK,YAAY,MAAM,QAAQ,SAAS;AAErD,cAAW,KACT,gBAAgB,MAAM,QAAQ,UAAU,wBACzC;;EAGH,MAAM,SAAS,kBAAkB,WAAW;AAE5C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAQ,MAAM,iCAAiC;AAC/C,WAAQ,KAAK,EAAE;;EAGjB,MAAM,WAAW,mBAAmB,OAAO,OAAO;AAClD,MAAI,SACF,SAAQ,OAAO,MAAM,WAAW,KAAK;AAGvC,UAAQ,QAAQ,0BAA0B,UAAU;AACpD,SAAO;;AAGT,SAAQ,MAAM,4BAA4B;CAE1C,MAAM,aAAa;EACjB;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,WAAW;EACX,kBAAkB;EAClB,YAAY;EACZ,SAAS;EACT,kBAAkB,QAAQ;EAC1B;EACD;AAED,KAAI,MAAM,WAAW,gBAAgB,OACnC,YAAW,KAAK,iBAAiB,MAAM,UAAU,cAAc;AAGjE,KAAI,cACF,YAAW,KAAK,iBAAiB,gBAAgB;AAGnD,KAAI,MAAM,eACR,YAAW,KAAK,qBAAqB,MAAM,iBAAiB;AAG9D,KAAI,MAAM,SAAS;AACjB,aAAW,KAAK,aAAa,MAAM,QAAQ,OAAO;AAClD,MAAI,MAAM,QAAQ,OAChB,YAAW,KAAK,YAAY,MAAM,QAAQ,SAAS;AAErD,aAAW,KACT,gBAAgB,MAAM,QAAQ,UAAU,wBACzC;;CAGH,MAAM,SAAS,kBAAkB,WAAW;AAE5C,KAAI,CAAC,OAAO,SAAS;AACnB,UAAQ,MAAM,iCAAiC;AAC/C,UAAQ,KAAK,EAAE;;CAGjB,MAAM,WAAW,mBAAmB,OAAO,OAAO;AAClD,KAAI,SACF,SAAQ,OAAO,MAAM,WAAW,KAAK;AAGvC,SAAQ,QAAQ,0BAA0B,UAAU;AACpD,QAAO;;;;;AAMT,SAAS,iBAAiB,UAAkB,SAA0B;AAcpE,QAbe,WACb;EACE;EACA;EACA;EACA;EACA;EACA;EACA;EACD,EACD,EAAE,cAAc,MAAM,CACvB,KAEiB"}

package/dist/cloud/gcloud.mjs

@@ -1,5 +1,5 @@
 import { consola } from "consola";
-import { execaCommandSync, execaSync } from "execa";
+import { execa, execaCommandSync, execaSync } from "execa";
 
 //#region src/cloud/gcloud.ts
 /**
@@ -75,9 +75,9 @@ function checkGcloudAvailable() {
 	}
 }
 /**
-* Check if Docker CLI is available.
+* Check if the Docker CLI binary is installed.
 */
-function isDockerAvailable() {
+function isDockerInstalled() {
 	try {
 		execaSync("docker", ["--version"]);
 		return true;
@@ -85,7 +85,62 @@ function isDockerAvailable() {
 		return false;
 	}
 }
+/**
+* Check if the Docker daemon is running by executing `docker info`.
+*/
+function isDockerDaemonRunning() {
+	try {
+		execaSync("docker", ["info"], { stdio: "pipe" });
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Attempt to start the Docker daemon.
+* - macOS: opens the Docker Desktop application
+* - Linux: starts the docker systemd service
+* - Other platforms: unsupported, returns false
+*/
+function startDockerDaemon() {
+	try {
+		if (process.platform === "darwin") {
+			execaSync("open", ["-a", "Docker"]);
+			return true;
+		}
+		if (process.platform === "linux") {
+			execaSync("systemctl", ["start", "docker"]);
+			return true;
+		}
+		return false;
+	} catch {
+		return false;
+	}
+}
+/**
+* Poll `docker info` until the daemon is responsive or the timeout is reached.
+* Shows a spinner while waiting.
+*
+* @param timeoutMs - Maximum time to wait in milliseconds (default: 30000)
+* @param intervalMs - Polling interval in milliseconds (default: 2000)
+* @returns true if the daemon became available, false on timeout
+*/
+async function waitForDockerDaemon(timeoutMs = 3e4, intervalMs = 2e3) {
+	if (isDockerDaemonRunning()) return true;
+	consola.start("Waiting for Docker daemon to start...");
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		await new Promise((resolve) => setTimeout(resolve, intervalMs));
+		try {
+			await execa("docker", ["info"], { stdio: "pipe" });
+			consola.success("Docker daemon is running");
+			return true;
+		} catch {}
+	}
+	consola.fail("Docker daemon did not start in time");
+	return false;
+}
 
 //#endregion
-export { checkGcloudAvailable, gcloudExecCapture, gcloudJson, isDockerAvailable, shellExecCapture };
+export { checkGcloudAvailable, gcloudExecCapture, gcloudJson, isDockerDaemonRunning, isDockerInstalled, shellExecCapture, startDockerDaemon, waitForDockerDaemon };
 //# sourceMappingURL=gcloud.mjs.map

package/dist/cloud/gcloud.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"gcloud.mjs","names":[],"sources":["../../src/cloud/gcloud.ts"],"sourcesContent":["import { execaCommandSync, execaSync } from \"execa\";\nimport { consola } from \"consola\";\n\nexport interface CapturedExecResult {\n  success: boolean;\n  output: string;\n  stderr: string;\n}\n\n/**\n * Execute a gcloud command and return the parsed JSON output.\n * Throws on non-zero exit code unless `ignoreErrors` is set.\n */\nexport function gcloudJson<T = unknown>(\n  args: string[],\n  options?: { ignoreErrors?: boolean },\n): T | undefined {\n  try {\n    const result = execaSync(\"gcloud\", [...args, \"--format=json\"]);\n    return JSON.parse(result.stdout) as T;\n  } catch (error) {\n    if (options?.ignoreErrors) {\n      return undefined;\n    }\n    throw error;\n  }\n}\n\n/**\n * Execute a gcloud command with stdio inherited (shows output in terminal).\n * Returns whether the command succeeded.\n */\nexport function gcloudExec(\n  args: string[],\n  options?: { cwd?: string },\n): boolean {\n  try {\n    execaSync(\"gcloud\", args, {\n      stdio: \"inherit\",\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Execute a shell command with stdio inherited.\n * Uses shell execution for commands that need shell features (like pnpm).\n */\nexport function shellExec(\n  command: string,\n  options?: { cwd?: string },\n): boolean {\n  try {\n    execaCommandSync(command, {\n      stdio: \"inherit\",\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Execute a gcloud command and capture all output instead of streaming it.\n * Returns success status and captured stdout/stderr for the caller to handle.\n */\nexport function gcloudExecCapture(\n  args: string[],\n  options?: { cwd?: string },\n): CapturedExecResult {\n  try {\n    const result = execaSync(\"gcloud\", args, {\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return { success: true, output: result.stdout, stderr: result.stderr };\n  } catch (error) {\n    const stderr = (error as { stderr?: string }).stderr ?? \"\";\n    const stdout = (error as { stdout?: string }).stdout ?? \"\";\n    return {\n      success: false,\n      output: [stderr, stdout].filter(Boolean).join(\"\\n\"),\n      stderr,\n    };\n  }\n}\n\n/**\n * Execute a shell command and capture all output instead of streaming it.\n * Returns success status and captured output for the caller to handle.\n */\nexport function shellExecCapture(\n  command: string,\n  options?: { cwd?: string },\n): CapturedExecResult {\n  try {\n    const result = execaCommandSync(command, {\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return { success: true, output: result.stdout, stderr: result.stderr };\n  } catch (error) {\n    const stderr = (error as { stderr?: string }).stderr ?? \"\";\n    const stdout = (error as { stdout?: string }).stdout ?? \"\";\n    return {\n      success: false,\n      output: [stderr, stdout].filter(Boolean).join(\"\\n\"),\n      stderr,\n    };\n  }\n}\n\n/**\n * Check if gcloud CLI is available and authenticated.\n */\nexport function checkGcloudAvailable(): void {\n  try {\n    execaSync(\"gcloud\", [\"--version\"]);\n  } catch {\n    consola.error(\n      \"gcloud CLI is not installed or not in PATH.\\n\" +\n        \"Install it from: https://cloud.google.com/sdk/docs/install\",\n    );\n    process.exit(1);\n  }\n}\n\n/**\n * Check if Docker CLI is available.\n */\nexport function isDockerAvailable(): boolean {\n  try {\n    execaSync(\"docker\", [\"--version\"]);\n    return true;\n  } catch {\n    return false;\n  }\n}\n"],"mappings":";;;;;;;;AAaA,SAAgB,WACd,MACA,SACe;AACf,KAAI;EACF,MAAM,SAAS,UAAU,UAAU,CAAC,GAAG,MAAM,gBAAgB,CAAC;AAC9D,SAAO,KAAK,MAAM,OAAO,OAAO;UACzB,OAAO;AACd,MAAI,SAAS,aACX;AAEF,QAAM;;;;;;;AAgDV,SAAgB,kBACd,MACA,SACoB;AACpB,KAAI;EACF,MAAM,SAAS,UAAU,UAAU,MAAM;GACvC,KAAK,SAAS;GACd,QAAQ;GACT,CAAC;AACF,SAAO;GAAE,SAAS;GAAM,QAAQ,OAAO;GAAQ,QAAQ,OAAO;GAAQ;UAC/D,OAAO;EACd,MAAM,SAAU,MAA8B,UAAU;AAExD,SAAO;GACL,SAAS;GACT,QAAQ,CAAC,QAHK,MAA8B,UAAU,GAG9B,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;GACnD;GACD;;;;;;;AAQL,SAAgB,iBACd,SACA,SACoB;AACpB,KAAI;EACF,MAAM,SAAS,iBAAiB,SAAS;GACvC,KAAK,SAAS;GACd,QAAQ;GACT,CAAC;AACF,SAAO;GAAE,SAAS;GAAM,QAAQ,OAAO;GAAQ,QAAQ,OAAO;GAAQ;UAC/D,OAAO;EACd,MAAM,SAAU,MAA8B,UAAU;AAExD,SAAO;GACL,SAAS;GACT,QAAQ,CAAC,QAHK,MAA8B,UAAU,GAG9B,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;GACnD;GACD;;;;;;AAOL,SAAgB,uBAA6B;AAC3C,KAAI;AACF,YAAU,UAAU,CAAC,YAAY,CAAC;SAC5B;AACN,UAAQ,MACN,0GAED;AACD,UAAQ,KAAK,EAAE;;;;;;AAOnB,SAAgB,oBAA6B;AAC3C,KAAI;AACF,YAAU,UAAU,CAAC,YAAY,CAAC;AAClC,SAAO;SACD;AACN,SAAO"}
+{"version":3,"file":"gcloud.mjs","names":[],"sources":["../../src/cloud/gcloud.ts"],"sourcesContent":["import { execaCommandSync, execaSync } from \"execa\";\nimport { execa } from \"execa\";\nimport { consola } from \"consola\";\n\nexport interface CapturedExecResult {\n  success: boolean;\n  output: string;\n  stderr: string;\n}\n\n/**\n * Execute a gcloud command and return the parsed JSON output.\n * Throws on non-zero exit code unless `ignoreErrors` is set.\n */\nexport function gcloudJson<T = unknown>(\n  args: string[],\n  options?: { ignoreErrors?: boolean },\n): T | undefined {\n  try {\n    const result = execaSync(\"gcloud\", [...args, \"--format=json\"]);\n    return JSON.parse(result.stdout) as T;\n  } catch (error) {\n    if (options?.ignoreErrors) {\n      return undefined;\n    }\n    throw error;\n  }\n}\n\n/**\n * Execute a gcloud command with stdio inherited (shows output in terminal).\n * Returns whether the command succeeded.\n */\nexport function gcloudExec(\n  args: string[],\n  options?: { cwd?: string },\n): boolean {\n  try {\n    execaSync(\"gcloud\", args, {\n      stdio: \"inherit\",\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Execute a shell command with stdio inherited.\n * Uses shell execution for commands that need shell features (like pnpm).\n */\nexport function shellExec(\n  command: string,\n  options?: { cwd?: string },\n): boolean {\n  try {\n    execaCommandSync(command, {\n      stdio: \"inherit\",\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Execute a gcloud command and capture all output instead of streaming it.\n * Returns success status and captured stdout/stderr for the caller to handle.\n */\nexport function gcloudExecCapture(\n  args: string[],\n  options?: { cwd?: string },\n): CapturedExecResult {\n  try {\n    const result = execaSync(\"gcloud\", args, {\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return { success: true, output: result.stdout, stderr: result.stderr };\n  } catch (error) {\n    const stderr = (error as { stderr?: string }).stderr ?? \"\";\n    const stdout = (error as { stdout?: string }).stdout ?? \"\";\n    return {\n      success: false,\n      output: [stderr, stdout].filter(Boolean).join(\"\\n\"),\n      stderr,\n    };\n  }\n}\n\n/**\n * Execute a shell command and capture all output instead of streaming it.\n * Returns success status and captured output for the caller to handle.\n */\nexport function shellExecCapture(\n  command: string,\n  options?: { cwd?: string },\n): CapturedExecResult {\n  try {\n    const result = execaCommandSync(command, {\n      cwd: options?.cwd,\n      reject: true,\n    });\n    return { success: true, output: result.stdout, stderr: result.stderr };\n  } catch (error) {\n    const stderr = (error as { stderr?: string }).stderr ?? \"\";\n    const stdout = (error as { stdout?: string }).stdout ?? \"\";\n    return {\n      success: false,\n      output: [stderr, stdout].filter(Boolean).join(\"\\n\"),\n      stderr,\n    };\n  }\n}\n\n/**\n * Check if gcloud CLI is available and authenticated.\n */\nexport function checkGcloudAvailable(): void {\n  try {\n    execaSync(\"gcloud\", [\"--version\"]);\n  } catch {\n    consola.error(\n      \"gcloud CLI is not installed or not in PATH.\\n\" +\n        \"Install it from: https://cloud.google.com/sdk/docs/install\",\n    );\n    process.exit(1);\n  }\n}\n\n/**\n * Check if the Docker CLI binary is installed.\n */\nexport function isDockerInstalled(): boolean {\n  try {\n    execaSync(\"docker\", [\"--version\"]);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Check if the Docker daemon is running by executing `docker info`.\n */\nexport function isDockerDaemonRunning(): boolean {\n  try {\n    execaSync(\"docker\", [\"info\"], { stdio: \"pipe\" });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Attempt to start the Docker daemon.\n * - macOS: opens the Docker Desktop application\n * - Linux: starts the docker systemd service\n * - Other platforms: unsupported, returns false\n */\nexport function startDockerDaemon(): boolean {\n  try {\n    if (process.platform === \"darwin\") {\n      execaSync(\"open\", [\"-a\", \"Docker\"]);\n      return true;\n    }\n\n    if (process.platform === \"linux\") {\n      execaSync(\"systemctl\", [\"start\", \"docker\"]);\n      return true;\n    }\n\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Poll `docker info` until the daemon is responsive or the timeout is reached.\n * Shows a spinner while waiting.\n *\n * @param timeoutMs - Maximum time to wait in milliseconds (default: 30000)\n * @param intervalMs - Polling interval in milliseconds (default: 2000)\n * @returns true if the daemon became available, false on timeout\n */\nexport async function waitForDockerDaemon(\n  timeoutMs = 30_000,\n  intervalMs = 2_000,\n): Promise<boolean> {\n  if (isDockerDaemonRunning()) return true;\n\n  consola.start(\"Waiting for Docker daemon to start...\");\n\n  const deadline = Date.now() + timeoutMs;\n\n  while (Date.now() < deadline) {\n    await new Promise((resolve) => setTimeout(resolve, intervalMs));\n\n    try {\n      await execa(\"docker\", [\"info\"], { stdio: \"pipe\" });\n      consola.success(\"Docker daemon is running\");\n      return true;\n    } catch {\n      /** Daemon not ready yet */\n    }\n  }\n\n  consola.fail(\"Docker daemon did not start in time\");\n  return false;\n}\n"],"mappings":";;;;;;;;AAcA,SAAgB,WACd,MACA,SACe;AACf,KAAI;EACF,MAAM,SAAS,UAAU,UAAU,CAAC,GAAG,MAAM,gBAAgB,CAAC;AAC9D,SAAO,KAAK,MAAM,OAAO,OAAO;UACzB,OAAO;AACd,MAAI,SAAS,aACX;AAEF,QAAM;;;;;;;AAgDV,SAAgB,kBACd,MACA,SACoB;AACpB,KAAI;EACF,MAAM,SAAS,UAAU,UAAU,MAAM;GACvC,KAAK,SAAS;GACd,QAAQ;GACT,CAAC;AACF,SAAO;GAAE,SAAS;GAAM,QAAQ,OAAO;GAAQ,QAAQ,OAAO;GAAQ;UAC/D,OAAO;EACd,MAAM,SAAU,MAA8B,UAAU;AAExD,SAAO;GACL,SAAS;GACT,QAAQ,CAAC,QAHK,MAA8B,UAAU,GAG9B,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;GACnD;GACD;;;;;;;AAQL,SAAgB,iBACd,SACA,SACoB;AACpB,KAAI;EACF,MAAM,SAAS,iBAAiB,SAAS;GACvC,KAAK,SAAS;GACd,QAAQ;GACT,CAAC;AACF,SAAO;GAAE,SAAS;GAAM,QAAQ,OAAO;GAAQ,QAAQ,OAAO;GAAQ;UAC/D,OAAO;EACd,MAAM,SAAU,MAA8B,UAAU;AAExD,SAAO;GACL,SAAS;GACT,QAAQ,CAAC,QAHK,MAA8B,UAAU,GAG9B,CAAC,OAAO,QAAQ,CAAC,KAAK,KAAK;GACnD;GACD;;;;;;AAOL,SAAgB,uBAA6B;AAC3C,KAAI;AACF,YAAU,UAAU,CAAC,YAAY,CAAC;SAC5B;AACN,UAAQ,MACN,0GAED;AACD,UAAQ,KAAK,EAAE;;;;;;AAOnB,SAAgB,oBAA6B;AAC3C,KAAI;AACF,YAAU,UAAU,CAAC,YAAY,CAAC;AAClC,SAAO;SACD;AACN,SAAO;;;;;;AAOX,SAAgB,wBAAiC;AAC/C,KAAI;AACF,YAAU,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,QAAQ,CAAC;AAChD,SAAO;SACD;AACN,SAAO;;;;;;;;;AAUX,SAAgB,oBAA6B;AAC3C,KAAI;AACF,MAAI,QAAQ,aAAa,UAAU;AACjC,aAAU,QAAQ,CAAC,MAAM,SAAS,CAAC;AACnC,UAAO;;AAGT,MAAI,QAAQ,aAAa,SAAS;AAChC,aAAU,aAAa,CAAC,SAAS,SAAS,CAAC;AAC3C,UAAO;;AAGT,SAAO;SACD;AACN,SAAO;;;;;;;;;;;AAYX,eAAsB,oBACpB,YAAY,KACZ,aAAa,KACK;AAClB,KAAI,uBAAuB,CAAE,QAAO;AAEpC,SAAQ,MAAM,wCAAwC;CAEtD,MAAM,WAAW,KAAK,KAAK,GAAG;AAE9B,QAAO,KAAK,KAAK,GAAG,UAAU;AAC5B,QAAM,IAAI,SAAS,YAAY,WAAW,SAAS,WAAW,CAAC;AAE/D,MAAI;AACF,SAAM,MAAM,UAAU,CAAC,OAAO,EAAE,EAAE,OAAO,QAAQ,CAAC;AAClD,WAAQ,QAAQ,2BAA2B;AAC3C,UAAO;UACD;;AAKV,SAAQ,KAAK,sCAAsC;AACnD,QAAO"}

package/dist/config.d.mts

@@ -3,6 +3,12 @@
 interface RunnerEnvOptions {
   /** GCP project ID — sets GOOGLE_CLOUD_PROJECT automatically */
   project: string;
+  /**
+   * Path(s) to .env files to load, resolved relative to the service directory.
+   * Variables from these files have lower precedence than explicit `env` values.
+   * When multiple files are specified, earlier files take precedence over later ones.
+   */
+  envFile?: string | string[];
   /** Additional environment variables to set before the job runs */
   env?: Record<string, string>;
   /** Secret names to load from GCP Secret Manager */
@@ -19,6 +25,15 @@ interface CloudResources {
   /** Maximum number of tasks that can run in parallel. Default: unset (no limit) */
   parallelism?: number;
 }
+/** Direct VPC egress configuration for private network access (e.g., Redis) */
+interface CloudNetworkConfig {
+  /** VPC network name (e.g., "default") */
+  name: string;
+  /** VPC subnet name (e.g., "default") */
+  subnet?: string;
+  /** VPC egress mode. Default: "private-ranges-only" */
+  egress?: "all-traffic" | "private-ranges-only";
+}
 /** Configuration for Cloud Run Jobs execution */
 interface CloudConfig {
   /** Cloud Run Job name (e.g., "loads-predictions-jobs") */
@@ -36,6 +51,8 @@ interface CloudConfig {
    * Requires Docker to be installed and running. Default: true.
    */
   buildLocal?: boolean;
+  /** Direct VPC egress configuration for private network access */
+  network?: CloudNetworkConfig;
 }
 /** Full runner configuration provided by each service */
 interface RunnerConfig {
@@ -67,5 +84,5 @@ declare function defineRunnerConfig(config: RunnerConfig): RunnerConfig;
 /** Identity function for type-safe environment definition */
 declare function defineRunnerEnv(options: RunnerEnvOptions): RunnerEnvOptions;
 //#endregion
-export { CloudConfig, CloudResources, RunnerConfig, RunnerEnvOptions, defineRunnerConfig, defineRunnerEnv };
+export { CloudConfig, CloudNetworkConfig, CloudResources, RunnerConfig, RunnerEnvOptions, defineRunnerConfig, defineRunnerEnv };
 //# sourceMappingURL=config.d.mts.map

package/dist/config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["/** Environment configuration for a specific deployment target */\nexport interface RunnerEnvOptions {\n  /** GCP project ID — sets GOOGLE_CLOUD_PROJECT automatically */\n  project: string;\n  /** Additional environment variables to set before the job runs */\n  env?: Record<string, string>;\n  /** Secret names to load from GCP Secret Manager */\n  secrets?: string[];\n}\n\n/** Container resource limits for a Cloud Run Job */\nexport interface CloudResources {\n  /** Memory limit (e.g., \"512Mi\", \"1Gi\"). Default: \"512Mi\" */\n  memory?: string;\n  /** CPU limit (e.g., \"1\", \"2\"). Default: \"1\" */\n  cpu?: string;\n  /** Job timeout in seconds. Default: 86400 (24 hours) */\n  timeout?: number;\n  /** Maximum number of tasks that can run in parallel. Default: unset (no limit) */\n  parallelism?: number;\n}\n\n/** Configuration for Cloud Run Jobs execution */\nexport interface CloudConfig {\n  /** Cloud Run Job name (e.g., \"loads-predictions-jobs\") */\n  name: string;\n  /** GCP region. Default: \"us-central1\" */\n  region?: string;\n  /** Artifact Registry repository name. Default: \"cloud-run\" */\n  artifactRegistry?: string;\n  /** Container resource limits */\n  resources?: CloudResources;\n  /** Service account email for the Cloud Run Job */\n  serviceAccount?: string;\n  /**\n   * Build Docker images locally instead of using Cloud Build.\n   * Requires Docker to be installed and running. Default: true.\n   */\n  buildLocal?: boolean;\n}\n\n/** Full runner configuration provided by each service */\nexport interface RunnerConfig {\n  /**\n   * Absolute path to the directory containing job scripts.\n   * Default: `dist/jobs` relative to cwd.\n   */\n  jobsDirectory?: string;\n  /** Optional initialization function called before the job runs (skipped for --help) */\n  initialize?: () => void | Promise<void>;\n  /** Optional custom logger (defaults to console) */\n  logger?: {\n    info: (message: string) => void;\n    error: (message: string) => void;\n  };\n  /** Named environments (e.g., stag, prod) */\n  environments: Record<string, RunnerEnvOptions>;\n  /** Cloud Run Jobs configuration (required for `job cloud run/deploy` commands) */\n  cloud?: CloudConfig;\n  /**\n   * Command to build workspace dependencies before running jobs.\n   * Set to `false` to skip the build step entirely.\n   * Default: \"turbo build\"\n   */\n  buildCommand?: string | false;\n}\n\n/** Identity function for type-safe runner config definition */\nexport function defineRunnerConfig(config: RunnerConfig): RunnerConfig {\n  return config;\n}\n\n/** Identity function for type-safe environment definition */\nexport function defineRunnerEnv(options: RunnerEnvOptions): RunnerEnvOptions {\n  return options;\n}\n"],"mappings":";;AAoEA,SAAgB,mBAAmB,QAAoC;AACrE,QAAO;;;AAIT,SAAgB,gBAAgB,SAA6C;AAC3E,QAAO"}
+{"version":3,"file":"config.mjs","names":[],"sources":["../src/config.ts"],"sourcesContent":["/** Environment configuration for a specific deployment target */\nexport interface RunnerEnvOptions {\n  /** GCP project ID — sets GOOGLE_CLOUD_PROJECT automatically */\n  project: string;\n  /**\n   * Path(s) to .env files to load, resolved relative to the service directory.\n   * Variables from these files have lower precedence than explicit `env` values.\n   * When multiple files are specified, earlier files take precedence over later ones.\n   */\n  envFile?: string | string[];\n  /** Additional environment variables to set before the job runs */\n  env?: Record<string, string>;\n  /** Secret names to load from GCP Secret Manager */\n  secrets?: string[];\n}\n\n/** Container resource limits for a Cloud Run Job */\nexport interface CloudResources {\n  /** Memory limit (e.g., \"512Mi\", \"1Gi\"). Default: \"512Mi\" */\n  memory?: string;\n  /** CPU limit (e.g., \"1\", \"2\"). Default: \"1\" */\n  cpu?: string;\n  /** Job timeout in seconds. Default: 86400 (24 hours) */\n  timeout?: number;\n  /** Maximum number of tasks that can run in parallel. Default: unset (no limit) */\n  parallelism?: number;\n}\n\n/** Direct VPC egress configuration for private network access (e.g., Redis) */\nexport interface CloudNetworkConfig {\n  /** VPC network name (e.g., \"default\") */\n  name: string;\n  /** VPC subnet name (e.g., \"default\") */\n  subnet?: string;\n  /** VPC egress mode. Default: \"private-ranges-only\" */\n  egress?: \"all-traffic\" | \"private-ranges-only\";\n}\n\n/** Configuration for Cloud Run Jobs execution */\nexport interface CloudConfig {\n  /** Cloud Run Job name (e.g., \"loads-predictions-jobs\") */\n  name: string;\n  /** GCP region. Default: \"us-central1\" */\n  region?: string;\n  /** Artifact Registry repository name. Default: \"cloud-run\" */\n  artifactRegistry?: string;\n  /** Container resource limits */\n  resources?: CloudResources;\n  /** Service account email for the Cloud Run Job */\n  serviceAccount?: string;\n  /**\n   * Build Docker images locally instead of using Cloud Build.\n   * Requires Docker to be installed and running. Default: true.\n   */\n  buildLocal?: boolean;\n  /** Direct VPC egress configuration for private network access */\n  network?: CloudNetworkConfig;\n}\n\n/** Full runner configuration provided by each service */\nexport interface RunnerConfig {\n  /**\n   * Absolute path to the directory containing job scripts.\n   * Default: `dist/jobs` relative to cwd.\n   */\n  jobsDirectory?: string;\n  /** Optional initialization function called before the job runs (skipped for --help) */\n  initialize?: () => void | Promise<void>;\n  /** Optional custom logger (defaults to console) */\n  logger?: {\n    info: (message: string) => void;\n    error: (message: string) => void;\n  };\n  /** Named environments (e.g., stag, prod) */\n  environments: Record<string, RunnerEnvOptions>;\n  /** Cloud Run Jobs configuration (required for `job cloud run/deploy` commands) */\n  cloud?: CloudConfig;\n  /**\n   * Command to build workspace dependencies before running jobs.\n   * Set to `false` to skip the build step entirely.\n   * Default: \"turbo build\"\n   */\n  buildCommand?: string | false;\n}\n\n/** Identity function for type-safe runner config definition */\nexport function defineRunnerConfig(config: RunnerConfig): RunnerConfig {\n  return config;\n}\n\n/** Identity function for type-safe environment definition */\nexport function defineRunnerEnv(options: RunnerEnvOptions): RunnerEnvOptions {\n  return options;\n}\n"],"mappings":";;AAsFA,SAAgB,mBAAmB,QAAoC;AACrE,QAAO;;;AAIT,SAAgB,gBAAgB,SAA6C;AAC3E,QAAO"}

package/dist/env-file.mjs

@@ -0,0 +1,28 @@
+import { parseEnv } from "node:util";
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+
+//#region src/env-file.ts
+/**
+* Parse one or more .env files and return the merged key-value pairs.
+*
+* Files are processed in order. Earlier files take precedence over later ones
+* (first-wins), matching the dotenv convention.
+*/
+function parseEnvFiles(envFile, cwd) {
+	if (!envFile) return {};
+	const files = Array.isArray(envFile) ? envFile : [envFile];
+	const baseDir = cwd ?? process.cwd();
+	const result = {};
+	for (const file of files) {
+		const filePath = path.resolve(baseDir, file);
+		if (!existsSync(filePath)) throw new Error(`Environment file not found: ${file}\nResolved path: ${filePath}`);
+		const parsed = parseEnv(readFileSync(filePath, "utf-8"));
+		for (const [key, value] of Object.entries(parsed)) if (value !== void 0 && !Object.hasOwn(result, key)) result[key] = value;
+	}
+	return result;
+}
+
+//#endregion
+export { parseEnvFiles };
+//# sourceMappingURL=env-file.mjs.map

package/dist/env-file.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-file.mjs","names":[],"sources":["../src/env-file.ts"],"sourcesContent":["import { existsSync, readFileSync } from \"node:fs\";\nimport path from \"node:path\";\nimport { parseEnv } from \"node:util\";\n\n/**\n * Parse one or more .env files and return the merged key-value pairs.\n *\n * Files are processed in order. Earlier files take precedence over later ones\n * (first-wins), matching the dotenv convention.\n */\nexport function parseEnvFiles(\n  envFile: string | string[] | undefined,\n  cwd?: string,\n): Record<string, string> {\n  if (!envFile) return {};\n\n  const files = Array.isArray(envFile) ? envFile : [envFile];\n  const baseDir = cwd ?? process.cwd();\n  const result: Record<string, string> = {};\n\n  for (const file of files) {\n    const filePath = path.resolve(baseDir, file);\n\n    if (!existsSync(filePath)) {\n      throw new Error(\n        `Environment file not found: ${file}\\nResolved path: ${filePath}`,\n      );\n    }\n\n    const content = readFileSync(filePath, \"utf-8\");\n    const parsed = parseEnv(content);\n\n    for (const [key, value] of Object.entries(parsed)) {\n      if (value !== undefined && !Object.hasOwn(result, key)) {\n        result[key] = value;\n      }\n    }\n  }\n\n  return result;\n}\n"],"mappings":";;;;;;;;;;;AAUA,SAAgB,cACd,SACA,KACwB;AACxB,KAAI,CAAC,QAAS,QAAO,EAAE;CAEvB,MAAM,QAAQ,MAAM,QAAQ,QAAQ,GAAG,UAAU,CAAC,QAAQ;CAC1D,MAAM,UAAU,OAAO,QAAQ,KAAK;CACpC,MAAM,SAAiC,EAAE;AAEzC,MAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,WAAW,KAAK,QAAQ,SAAS,KAAK;AAE5C,MAAI,CAAC,WAAW,SAAS,CACvB,OAAM,IAAI,MACR,+BAA+B,KAAK,mBAAmB,WACxD;EAIH,MAAM,SAAS,SADC,aAAa,UAAU,QAAQ,CACf;AAEhC,OAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,CAC/C,KAAI,UAAU,UAAa,CAAC,OAAO,OAAO,QAAQ,IAAI,CACpD,QAAO,OAAO;;AAKpB,QAAO"}

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { CloudConfig, CloudResources, RunnerConfig, RunnerEnvOptions, defineRunnerConfig, defineRunnerEnv } from "./config.mjs";
+import { CloudConfig, CloudNetworkConfig, CloudResources, RunnerConfig, RunnerEnvOptions, defineRunnerConfig, defineRunnerEnv } from "./config.mjs";
 import { FlagAliases, JobFunction, JobInfo, JobMetadata, JobOptions, RunJobOptions } from "./types.mjs";
 import { defineJob } from "./define-job.mjs";
 import { discoverJobs } from "./discover-jobs.mjs";
 import { FieldInfo, extractFieldInfo, formatZodError, generateSchemaHelp, schemaToParseArgsOptions } from "./help.mjs";
 import { TaskContext, getTaskContext } from "./task-context.mjs";
 import { runJob } from "./run-job.mjs";
-export { type CloudConfig, type CloudResources, type FieldInfo, type FlagAliases, type JobFunction, type JobInfo, type JobMetadata, type JobOptions, type RunJobOptions, type RunnerConfig, type RunnerEnvOptions, type TaskContext, defineJob, defineRunnerConfig, defineRunnerEnv, discoverJobs, extractFieldInfo, formatZodError, generateSchemaHelp, getTaskContext, runJob, schemaToParseArgsOptions };
+export { type CloudConfig, type CloudNetworkConfig, type CloudResources, type FieldInfo, type FlagAliases, type JobFunction, type JobInfo, type JobMetadata, type JobOptions, type RunJobOptions, type RunnerConfig, type RunnerEnvOptions, type TaskContext, defineJob, defineRunnerConfig, defineRunnerEnv, discoverJobs, extractFieldInfo, formatZodError, generateSchemaHelp, getTaskContext, runJob, schemaToParseArgsOptions };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gcp-job-runner",
-  "version": "1.4.1",
+  "version": "1.6.0",
   "description": "Run schema-driven Cloud Run jobs seamlessly in any environment",
   "license": "MIT",
   "repository": {
@@ -44,19 +44,19 @@
     "@google-cloud/secret-manager": "^6.1.1",
     "consola": "^3.4.0",
     "execa": "^9.6.1",
-    "isolate-package": "1.27.0",
+    "isolate-package": "1.28.2",
     "zod": "^4.3.6"
   },
   "devDependencies": {
-    "@codecompose/typescript-config": "2.3.0",
-    "@types/node": "^25.0.10",
+    "@codecompose/typescript-config": "3.0.0",
+    "@types/node": "^25.3.0",
     "del-cli": "^7.0.0",
     "husky": "^9.1.7",
     "lint-staged": "^16.2.7",
-    "oxfmt": "^0.32.0",
-    "oxlint": "^1.47.0",
+    "oxfmt": "^0.34.0",
+    "oxlint": "^1.49.0",
     "tsdown": "^0.20.1",
-    "typescript": "^5.9.3",
+    "typescript": "6.0.0-beta",
     "vitepress": "^1.6.4",
     "vitest": "^4.0.18"
   },
@@ -70,7 +70,7 @@
     ]
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.6.0"
   },
   "packageManager": "pnpm@10.22.0"
 }

package/src/cli.ts

@@ -17,6 +17,7 @@ import { discoverJobs } from "./discover-jobs";
 import { promptForArgs, selectJob } from "./interactive";
 import { runJob } from "./run-job";
 import { getSecrets } from "./secrets";
+import { parseEnvFiles } from "./env-file";
 import type { JobFunction } from "./types";
 
 const BIN_NAME = "job";
@@ -295,16 +296,25 @@ async function handleLocalRun(options: LocalRunOptions): Promise<void> {
 
   /** Set environment variables for local execution */
   process.env.NODE_ENV ??= "development";
-  process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;
   process.env.USE_CONSOLE_LOG ??= "true";
   process.env.LOG_COLORIZE ??= "true";
 
+  /** Load envFile variables (don't overwrite existing process.env values) */
+  const envFileVars = parseEnvFiles(envConfig.envFile);
+  for (const [key, value] of Object.entries(envFileVars)) {
+    process.env[key] ??= value;
+  }
+
+  /** Explicit env values override envFile values */
   if (envConfig.env) {
     for (const [key, value] of Object.entries(envConfig.env)) {
       process.env[key] = value;
     }
   }
 
+  /** Project always takes highest precedence */
+  process.env.GOOGLE_CLOUD_PROJECT = envConfig.project;
+
   if (envConfig.secrets && envConfig.secrets.length > 0) {
     const secrets = await getSecrets(envConfig.secrets);
     for (const [key, value] of Object.entries(secrets)) {

package/src/cloud/deploy.ts

@@ -2,10 +2,14 @@ import { existsSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
 import path from "node:path";
 import { consola } from "consola";
 import type { CloudConfig, RunnerEnvOptions } from "../config";
+import { parseEnvFiles } from "../env-file";
 import { generateDockerfile } from "./dockerfile";
 import {
   checkGcloudAvailable,
-  isDockerAvailable,
+  isDockerInstalled,
+  isDockerDaemonRunning,
+  startDockerDaemon,
+  waitForDockerDaemon,
   gcloudExecCapture,
   gcloudJson,
   shellExecCapture,
@@ -93,12 +97,67 @@ export async function prepareImage(
 
   checkGcloudAvailable();
 
-  if (buildLocal && !isDockerAvailable()) {
-    consola.warn(
-      "Docker is not available, falling back to Cloud Build. " +
-        "Install Docker for faster local builds: https://docs.docker.com/get-docker/",
-    );
-    buildLocal = false;
+  if (buildLocal) {
+    if (!isDockerInstalled()) {
+      consola.warn(
+        "Docker is not installed, falling back to Cloud Build. " +
+          "Install Docker for faster local builds: https://docs.docker.com/get-docker/",
+      );
+      buildLocal = false;
+    } else if (!isDockerDaemonRunning()) {
+      if (!process.stdin.isTTY) {
+        /** Non-interactive environment (CI) — fall back automatically */
+        consola.warn(
+          "Docker daemon is not running, falling back to Cloud Build.",
+        );
+        buildLocal = false;
+      } else {
+        const choice = await consola.prompt(
+          "Docker is installed but the daemon is not running.",
+          {
+            type: "select",
+            options: [
+              {
+                label: "Start Docker",
+                value: "start",
+                hint: "attempt to start the daemon",
+              },
+              {
+                label: "Use Cloud Build",
+                value: "cloud-build",
+                hint: "build remotely instead",
+              },
+            ],
+          },
+        );
+
+        if (typeof choice === "symbol") {
+          process.exit(0);
+        }
+
+        if (choice === "start") {
+          const started = startDockerDaemon();
+
+          if (!started) {
+            consola.warn(
+              "Could not start Docker automatically, falling back to Cloud Build.",
+            );
+            buildLocal = false;
+          } else {
+            const ready = await waitForDockerDaemon();
+
+            if (!ready) {
+              consola.warn(
+                "Docker daemon did not become ready in time, falling back to Cloud Build.",
+              );
+              buildLocal = false;
+            }
+          }
+        } else {
+          buildLocal = false;
+        }
+      }
+    }
   }
 
   /** Step 1: Run isolate to bundle workspace dependencies */
@@ -301,10 +360,12 @@ export async function createOrUpdateJob(
     { ignoreErrors: true },
   );
 
-  /** Build environment variables */
+  /** Build environment variables (envFile < env < project) */
+  const envFileVars = parseEnvFiles(envConfig.envFile);
   const envVars: Record<string, string> = {
-    GOOGLE_CLOUD_PROJECT: project,
+    ...envFileVars,
     ...envConfig.env,
+    GOOGLE_CLOUD_PROJECT: project,
   };
 
   const envVarsString = Object.entries(envVars)
@@ -351,6 +412,16 @@ export async function createOrUpdateJob(
       updateArgs.push(`--service-account=${cloud.serviceAccount}`);
     }
 
+    if (cloud.network) {
+      updateArgs.push(`--network=${cloud.network.name}`);
+      if (cloud.network.subnet) {
+        updateArgs.push(`--subnet=${cloud.network.subnet}`);
+      }
+      updateArgs.push(
+        `--vpc-egress=${cloud.network.egress ?? "private-ranges-only"}`,
+      );
+    }
+
     const result = gcloudExecCapture(updateArgs);
 
     if (!result.success) {
@@ -398,6 +469,16 @@ export async function createOrUpdateJob(
     createArgs.push(`--service-account=${cloud.serviceAccount}`);
   }
 
+  if (cloud.network) {
+    createArgs.push(`--network=${cloud.network.name}`);
+    if (cloud.network.subnet) {
+      createArgs.push(`--subnet=${cloud.network.subnet}`);
+    }
+    createArgs.push(
+      `--vpc-egress=${cloud.network.egress ?? "private-ranges-only"}`,
+    );
+  }
+
   const result = gcloudExecCapture(createArgs);
 
   if (!result.success) {

package/src/cloud/docker-fallback.test.ts

@@ -0,0 +1,195 @@
+import { describe, expect, it, vi, beforeEach, type Mock } from "vitest";
+import { consola } from "consola";
+
+/**
+ * Mock all external dependencies so we can test the Docker detection
+ * and fallback branching in prepareImage() without Docker or gcloud.
+ */
+vi.mock("consola", () => ({
+  consola: {
+    warn: vi.fn(),
+    start: vi.fn(),
+    success: vi.fn(),
+    info: vi.fn(),
+    error: vi.fn(),
+    prompt: vi.fn(),
+  },
+}));
+
+vi.mock("./gcloud", () => ({
+  checkGcloudAvailable: vi.fn(),
+  isDockerInstalled: vi.fn(() => true),
+  isDockerDaemonRunning: vi.fn(() => true),
+  startDockerDaemon: vi.fn(() => true),
+  waitForDockerDaemon: vi.fn(async () => true),
+  gcloudJson: vi.fn(),
+  gcloudExecCapture: vi.fn(() => ({ success: true, output: "", stderr: "" })),
+  shellExecCapture: vi.fn(() => ({ success: true, output: "", stderr: "" })),
+}));
+
+vi.mock("isolate-package", () => ({
+  isolate: vi.fn(async () => {}),
+}));
+
+vi.mock("./dockerfile", () => ({
+  generateDockerfile: vi.fn(() => "FROM node:22"),
+}));
+
+vi.mock("./hash", () => ({
+  hashDirectory: vi.fn(async () => "abc123"),
+}));
+
+vi.mock("node:fs", async () => {
+  const actual = await vi.importActual("node:fs");
+  return {
+    ...actual,
+    existsSync: vi.fn(() => false),
+    readFileSync: vi.fn(() => "{}"),
+    writeFileSync: vi.fn(),
+    unlinkSync: vi.fn(),
+  };
+});
+
+import {
+  isDockerInstalled,
+  isDockerDaemonRunning,
+  startDockerDaemon,
+  waitForDockerDaemon,
+  gcloudJson,
+} from "./gcloud";
+import { prepareImage, type DeployOptions } from "./deploy";
+
+const defaultOptions: DeployOptions = {
+  cloud: { name: "test-job", buildLocal: true },
+  envConfig: { project: "test-project" },
+  serviceDirectory: "/tmp/test-service",
+};
+
+/** Stub gcloudJson to report no existing image */
+function stubNoExistingImage() {
+  (gcloudJson as Mock).mockReturnValue(undefined);
+}
+
+describe("prepareImage Docker fallback", () => {
+  beforeEach(() => {
+    vi.restoreAllMocks();
+    /** Defaults: Docker installed, daemon running, no existing image */
+    (isDockerInstalled as Mock).mockReturnValue(true);
+    (isDockerDaemonRunning as Mock).mockReturnValue(true);
+    (startDockerDaemon as Mock).mockReturnValue(true);
+    (waitForDockerDaemon as Mock).mockResolvedValue(true);
+    stubNoExistingImage();
+  });
+
+  it("falls back to Cloud Build with warning when Docker is not installed", async () => {
+    (isDockerInstalled as Mock).mockReturnValue(false);
+
+    await prepareImage(defaultOptions);
+
+    expect(consola.warn).toHaveBeenCalledWith(
+      expect.stringContaining("Docker is not installed"),
+    );
+    expect(isDockerDaemonRunning).not.toHaveBeenCalled();
+  });
+
+  it("builds locally when Docker is installed and daemon is running", async () => {
+    await prepareImage(defaultOptions);
+
+    expect(consola.warn).not.toHaveBeenCalled();
+    expect(consola.prompt).not.toHaveBeenCalled();
+  });
+
+  describe("daemon not running, non-interactive (no TTY)", () => {
+    beforeEach(() => {
+      (isDockerDaemonRunning as Mock).mockReturnValue(false);
+      Object.defineProperty(process.stdin, "isTTY", {
+        value: false,
+        configurable: true,
+      });
+    });
+
+    it("falls back to Cloud Build without prompting", async () => {
+      await prepareImage(defaultOptions);
+
+      expect(consola.prompt).not.toHaveBeenCalled();
+      expect(consola.warn).toHaveBeenCalledWith(
+        expect.stringContaining("falling back to Cloud Build"),
+      );
+    });
+  });
+
+  describe("daemon not running, interactive (TTY)", () => {
+    beforeEach(() => {
+      (isDockerDaemonRunning as Mock).mockReturnValue(false);
+      Object.defineProperty(process.stdin, "isTTY", {
+        value: true,
+        configurable: true,
+      });
+    });
+
+    it("prompts the user when daemon is not running", async () => {
+      (consola.prompt as Mock).mockResolvedValue("cloud-build");
+
+      await prepareImage(defaultOptions);
+
+      expect(consola.prompt).toHaveBeenCalledWith(
+        expect.stringContaining("daemon is not running"),
+        expect.objectContaining({ type: "select" }),
+      );
+    });
+
+    it("falls back to Cloud Build when user chooses cloud-build", async () => {
+      (consola.prompt as Mock).mockResolvedValue("cloud-build");
+
+      await prepareImage(defaultOptions);
+
+      expect(startDockerDaemon).not.toHaveBeenCalled();
+    });
+
+    it("starts Docker and waits when user chooses start", async () => {
+      (consola.prompt as Mock).mockResolvedValue("start");
+
+      await prepareImage(defaultOptions);
+
+      expect(startDockerDaemon).toHaveBeenCalled();
+      expect(waitForDockerDaemon).toHaveBeenCalled();
+    });
+
+    it("falls back to Cloud Build when Docker fails to start", async () => {
+      (consola.prompt as Mock).mockResolvedValue("start");
+      (startDockerDaemon as Mock).mockReturnValue(false);
+
+      await prepareImage(defaultOptions);
+
+      expect(consola.warn).toHaveBeenCalledWith(
+        expect.stringContaining("Could not start Docker automatically"),
+      );
+      expect(waitForDockerDaemon).not.toHaveBeenCalled();
+    });
+
+    it("falls back to Cloud Build when daemon does not become ready in time", async () => {
+      (consola.prompt as Mock).mockResolvedValue("start");
+      (waitForDockerDaemon as Mock).mockResolvedValue(false);
+
+      await prepareImage(defaultOptions);
+
+      expect(consola.warn).toHaveBeenCalledWith(
+        expect.stringContaining("did not become ready in time"),
+      );
+    });
+
+    it("exits when user cancels the prompt", async () => {
+      (consola.prompt as Mock).mockResolvedValue(Symbol("cancel"));
+
+      const exitSpy = vi.spyOn(process, "exit").mockImplementation(() => {
+        throw new Error("process.exit");
+      });
+
+      await expect(prepareImage(defaultOptions)).rejects.toThrow(
+        "process.exit",
+      );
+
+      expect(exitSpy).toHaveBeenCalledWith(0);
+    });
+  });
+});

package/src/cloud/gcloud.ts

@@ -1,4 +1,5 @@
 import { execaCommandSync, execaSync } from "execa";
+import { execa } from "execa";
 import { consola } from "consola";
 
 export interface CapturedExecResult {
@@ -132,9 +133,9 @@ export function checkGcloudAvailable(): void {
 }
 
 /**
- * Check if Docker CLI is available.
+ * Check if the Docker CLI binary is installed.
  */
-export function isDockerAvailable(): boolean {
+export function isDockerInstalled(): boolean {
   try {
     execaSync("docker", ["--version"]);
     return true;
@@ -142,3 +143,73 @@ export function isDockerAvailable(): boolean {
     return false;
   }
 }
+
+/**
+ * Check if the Docker daemon is running by executing `docker info`.
+ */
+export function isDockerDaemonRunning(): boolean {
+  try {
+    execaSync("docker", ["info"], { stdio: "pipe" });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Attempt to start the Docker daemon.
+ * - macOS: opens the Docker Desktop application
+ * - Linux: starts the docker systemd service
+ * - Other platforms: unsupported, returns false
+ */
+export function startDockerDaemon(): boolean {
+  try {
+    if (process.platform === "darwin") {
+      execaSync("open", ["-a", "Docker"]);
+      return true;
+    }
+
+    if (process.platform === "linux") {
+      execaSync("systemctl", ["start", "docker"]);
+      return true;
+    }
+
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Poll `docker info` until the daemon is responsive or the timeout is reached.
+ * Shows a spinner while waiting.
+ *
+ * @param timeoutMs - Maximum time to wait in milliseconds (default: 30000)
+ * @param intervalMs - Polling interval in milliseconds (default: 2000)
+ * @returns true if the daemon became available, false on timeout
+ */
+export async function waitForDockerDaemon(
+  timeoutMs = 30_000,
+  intervalMs = 2_000,
+): Promise<boolean> {
+  if (isDockerDaemonRunning()) return true;
+
+  consola.start("Waiting for Docker daemon to start...");
+
+  const deadline = Date.now() + timeoutMs;
+
+  while (Date.now() < deadline) {
+    await new Promise((resolve) => setTimeout(resolve, intervalMs));
+
+    try {
+      await execa("docker", ["info"], { stdio: "pipe" });
+      consola.success("Docker daemon is running");
+      return true;
+    } catch {
+      /** Daemon not ready yet */
+    }
+  }
+
+  consola.fail("Docker daemon did not start in time");
+  return false;
+}

package/src/config.ts

@@ -2,6 +2,12 @@
 export interface RunnerEnvOptions {
   /** GCP project ID — sets GOOGLE_CLOUD_PROJECT automatically */
   project: string;
+  /**
+   * Path(s) to .env files to load, resolved relative to the service directory.
+   * Variables from these files have lower precedence than explicit `env` values.
+   * When multiple files are specified, earlier files take precedence over later ones.
+   */
+  envFile?: string | string[];
   /** Additional environment variables to set before the job runs */
   env?: Record<string, string>;
   /** Secret names to load from GCP Secret Manager */
@@ -20,6 +26,16 @@ export interface CloudResources {
   parallelism?: number;
 }
 
+/** Direct VPC egress configuration for private network access (e.g., Redis) */
+export interface CloudNetworkConfig {
+  /** VPC network name (e.g., "default") */
+  name: string;
+  /** VPC subnet name (e.g., "default") */
+  subnet?: string;
+  /** VPC egress mode. Default: "private-ranges-only" */
+  egress?: "all-traffic" | "private-ranges-only";
+}
+
 /** Configuration for Cloud Run Jobs execution */
 export interface CloudConfig {
   /** Cloud Run Job name (e.g., "loads-predictions-jobs") */
@@ -37,6 +53,8 @@ export interface CloudConfig {
    * Requires Docker to be installed and running. Default: true.
    */
   buildLocal?: boolean;
+  /** Direct VPC egress configuration for private network access */
+  network?: CloudNetworkConfig;
 }
 
 /** Full runner configuration provided by each service */

package/src/env-file.test.ts

@@ -0,0 +1,86 @@
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { parseEnvFiles } from "./env-file";
+
+describe("parseEnvFiles", () => {
+  let tempDir: string;
+
+  beforeAll(() => {
+    tempDir = mkdtempSync(path.join(os.tmpdir(), "env-file-test-"));
+
+    writeFileSync(
+      path.join(tempDir, ".env.stag"),
+      [
+        "# Staging config",
+        "API_URL=https://api.staging.example.com",
+        "DB_HOST=staging-db",
+        "SHARED=from-stag",
+        "",
+        "EMPTY_VALUE=",
+      ].join("\n"),
+    );
+
+    writeFileSync(
+      path.join(tempDir, ".env.prod"),
+      [
+        "API_URL=https://api.example.com",
+        "DB_HOST=prod-db",
+        "SHARED=from-prod",
+      ].join("\n"),
+    );
+
+    writeFileSync(
+      path.join(tempDir, ".env.local"),
+      ["SHARED=from-local", "LOCAL_ONLY=secret"].join("\n"),
+    );
+  });
+
+  afterAll(() => {
+    rmSync(tempDir, { recursive: true });
+  });
+
+  it("returns empty object when envFile is undefined", () => {
+    expect(parseEnvFiles(undefined)).toEqual({});
+  });
+
+  it("parses a single env file", () => {
+    const result = parseEnvFiles(".env.stag", tempDir);
+
+    expect(result).toEqual({
+      API_URL: "https://api.staging.example.com",
+      DB_HOST: "staging-db",
+      SHARED: "from-stag",
+      EMPTY_VALUE: "",
+    });
+  });
+
+  it("applies first-wins precedence across multiple files", () => {
+    const result = parseEnvFiles([".env.local", ".env.stag"], tempDir);
+
+    expect(result.SHARED).toBe("from-local");
+    expect(result.LOCAL_ONLY).toBe("secret");
+    expect(result.API_URL).toBe("https://api.staging.example.com");
+  });
+
+  it("throws when a file does not exist", () => {
+    expect(() => parseEnvFiles(".env.missing", tempDir)).toThrowError(
+      /Environment file not found: .env.missing/,
+    );
+  });
+
+  it("handles comments and blank lines", () => {
+    const result = parseEnvFiles(".env.stag", tempDir);
+
+    expect(Object.keys(result)).not.toContain("#");
+    expect(result.API_URL).toBe("https://api.staging.example.com");
+  });
+
+  it("accepts a single string instead of an array", () => {
+    const result = parseEnvFiles(".env.prod", tempDir);
+
+    expect(result.API_URL).toBe("https://api.example.com");
+    expect(result.DB_HOST).toBe("prod-db");
+  });
+});

package/src/env-file.ts

@@ -0,0 +1,41 @@
+import { existsSync, readFileSync } from "node:fs";
+import path from "node:path";
+import { parseEnv } from "node:util";
+
+/**
+ * Parse one or more .env files and return the merged key-value pairs.
+ *
+ * Files are processed in order. Earlier files take precedence over later ones
+ * (first-wins), matching the dotenv convention.
+ */
+export function parseEnvFiles(
+  envFile: string | string[] | undefined,
+  cwd?: string,
+): Record<string, string> {
+  if (!envFile) return {};
+
+  const files = Array.isArray(envFile) ? envFile : [envFile];
+  const baseDir = cwd ?? process.cwd();
+  const result: Record<string, string> = {};
+
+  for (const file of files) {
+    const filePath = path.resolve(baseDir, file);
+
+    if (!existsSync(filePath)) {
+      throw new Error(
+        `Environment file not found: ${file}\nResolved path: ${filePath}`,
+      );
+    }
+
+    const content = readFileSync(filePath, "utf-8");
+    const parsed = parseEnv(content);
+
+    for (const [key, value] of Object.entries(parsed)) {
+      if (value !== undefined && !Object.hasOwn(result, key)) {
+        result[key] = value;
+      }
+    }
+  }
+
+  return result;
+}

package/src/index.ts

@@ -13,6 +13,7 @@ export { runJob } from "./run-job";
 export type { TaskContext } from "./task-context";
 export type {
   CloudConfig,
+  CloudNetworkConfig,
   CloudResources,
   RunnerConfig,
   RunnerEnvOptions,