paratix 0.0.1 → 0.1.0

package/dist/cli.js

@@ -0,0 +1,779 @@
+import {
+  printCliHeader,
+  printCommandFailure,
+  printModuleResult,
+  printRecipeHeader,
+  printRunContext,
+  printSummary,
+  runSignalModules,
+  startModuleSpinner,
+  withRecipeOutputScope
+} from "./chunk-DUIGEB2J.js";
+import {
+  SshConnectionImpl,
+  assertValidModuleMetaEntries,
+  collectSshConfigErrors,
+  isSshdPortMetaEntry,
+  isSystemHostMetaEntry,
+  isSystemRebootMetaEntry,
+  loadDotEnvironment,
+  mergeEnvironment,
+  mergeEnvironmentFromMeta
+} from "./chunk-G3BMCQKU.js";
+
+// src/cli.ts
+import { Command } from "commander";
+import { realpathSync } from "fs";
+import { resolve } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+import { inspect } from "util";
+import pc from "picocolors";
+
+// src/dryRunRecipe.ts
+function shouldExecuteApplyDuringDryRun(module) {
+  return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
+}
+async function executeDryRunBlockingModule(parameters) {
+  const { childModule, connection, environment, verbose } = parameters;
+  startModuleSpinner(childModule.name);
+  const result = childModule._applyDryRun == null ? await childModule.apply(connection, environment) : await childModule._applyDryRun(connection, environment);
+  const nextEnvironment = result.meta == null ? environment : await mergeEnvironmentFromMeta(environment, result.meta);
+  printModuleResult(childModule.name, result.status, result._dryRunDetail ?? "(dry-run)");
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  return {
+    env: nextEnvironment,
+    shouldBreak: result.status === "failed" || result._stopRun === true,
+    status: result.status,
+    stopRun: result._stopRun
+  };
+}
+async function executeDryRunChildModule(parameters) {
+  const { childModule, environment, ssh, verbose } = parameters;
+  const connection = childModule.local === true ? null : ssh;
+  startModuleSpinner(childModule.name);
+  const checkResult = await childModule.check(connection, environment);
+  if (checkResult !== "ok" && shouldExecuteApplyDuringDryRun(childModule)) {
+    return executeDryRunBlockingModule({ childModule, connection, environment, verbose });
+  }
+  const status = checkResult === "ok" ? "ok" : "changed";
+  const suffix = checkResult === "ok" ? void 0 : "(dry-run)";
+  printModuleResult(childModule.name, status, suffix);
+  return { env: environment, shouldBreak: false, status };
+}
+async function dryRunRecipeModule(parameters) {
+  return withRecipeOutputScope(async () => {
+    const { environment, recipeModule, ssh } = parameters;
+    printRecipeHeader(recipeModule.name);
+    let aggregatedStatus = "ok";
+    let currentEnvironment = environment;
+    const verbose = parameters.options?.verbose ?? false;
+    for (const childModule of recipeModule._modules) {
+      const result = await executeDryRunChildModule({
+        childModule,
+        environment: currentEnvironment,
+        ssh,
+        verbose
+      });
+      if (result.shouldBreak) return result;
+      currentEnvironment = result.env;
+      if (result.status === "changed") aggregatedStatus = "changed";
+    }
+    return { env: currentEnvironment, shouldBreak: false, status: aggregatedStatus };
+  });
+}
+
+// src/runnerHelpers.ts
+var SIGNAL_EXIT_BASE = 128;
+var SIGTERM_NUMBER = 15;
+var SIGINT_NUMBER = 2;
+function signalExitCode(signal) {
+  return SIGNAL_EXIT_BASE + (signal === "SIGTERM" ? SIGTERM_NUMBER : SIGINT_NUMBER);
+}
+function resolveExitCode(shutdownSignal, stats) {
+  if (shutdownSignal != null) {
+    process.exitCode = signalExitCode(shutdownSignal);
+  } else if (stats.failed > 0) {
+    process.exitCode = 1;
+  }
+}
+
+// src/runner.ts
+function setupShutdownHandlers() {
+  let receivedSignal = null;
+  let ssh = null;
+  const promptAbortController = new AbortController();
+  const handleShutdownSignal = (signal) => {
+    if (receivedSignal != null) {
+      process.exit(signalExitCode(signal));
+    }
+    receivedSignal = signal;
+    promptAbortController.abort(new Error(`Terminal prompt interrupted by ${signal}`));
+    console.error(`
+Received ${signal}, shutting down\u2026`);
+    ssh?.disconnect();
+  };
+  process.on("SIGINT", handleShutdownSignal);
+  process.on("SIGTERM", handleShutdownSignal);
+  return {
+    handleShutdownSignal,
+    promptAbortSignal: promptAbortController.signal,
+    setSsh: (connection) => {
+      ssh = connection;
+    },
+    shutdownSignal: () => receivedSignal
+  };
+}
+var RunStats = class {
+  changed = 0;
+  failed = 0;
+  ok = 0;
+  signals = 0;
+  skipped = 0;
+  incrementSignals() {
+    this.signals++;
+  }
+  update(status) {
+    switch (status) {
+      case "changed": {
+        this.changed++;
+        break;
+      }
+      case "failed": {
+        this.failed++;
+        break;
+      }
+      case "ok": {
+        this.ok++;
+        break;
+      }
+      case "skipped": {
+        this.skipped++;
+        break;
+      }
+    }
+  }
+};
+function interruptedStepResult(environment) {
+  return { env: environment, shouldBreak: true };
+}
+function shouldBreakAfterResult(result) {
+  return result.status === "failed" || result._stopRun === true;
+}
+function interruptedBeforeApply(environment, shutdownSignal) {
+  if (shutdownSignal() == null) return void 0;
+  return interruptedStepResult(environment);
+}
+async function applyCheckedModule(parameters) {
+  const interrupted = interruptedBeforeApply(
+    parameters.currentEnvironment,
+    parameters.shutdownSignal
+  );
+  if (interrupted != null) return interrupted;
+  return applyModule({
+    currentEnvironment: parameters.currentEnvironment,
+    dryRun: parameters.dryRun,
+    ssh: parameters.ssh,
+    targetModule: parameters.targetModule,
+    verbose: parameters.verbose
+  });
+}
+function shouldExecuteApplyDuringDryRun2(module) {
+  return module._applyDryRun != null || module._dryRunBlocker === true || module._dryRunMetaProducer === true;
+}
+function handleCaughtStepError(parameters) {
+  if (parameters.shutdownSignal() != null) {
+    return interruptedStepResult(parameters.environment);
+  }
+  printModuleResult(parameters.moduleName, "failed");
+  printCommandFailure(parameters.error, parameters.verbose);
+  return { env: parameters.environment, shouldBreak: true, status: "failed" };
+}
+function isRecipe(target) {
+  return "_isRecipe" in target && target._isRecipe;
+}
+async function initializeEnvironment(options, definition) {
+  const dotEnvironment = options.envFile == null ? void 0 : await loadDotEnvironment(options.envFile);
+  return mergeEnvironment({}, dotEnvironment, definition.env, options.envOverrides);
+}
+async function handlePortChange(ssh, metaEntries) {
+  const portEntry = metaEntries?.find((entry) => isSshdPortMetaEntry(entry));
+  if (portEntry == null) return;
+  const newPort = portEntry.port;
+  ssh.addPort(newPort);
+  if (metaEntries?.some((entry) => isSystemRebootMetaEntry(entry)) ?? false) return;
+  try {
+    await ssh.reconnect();
+  } catch (error) {
+    console.error(
+      `Failed to reconnect on port ${newPort} after port change: ${String(error)}. Verify that port ${newPort} is allowed by the server's firewall rules.`
+    );
+    throw error;
+  }
+}
+async function handleReboot(ssh, metaEntries) {
+  if (!(metaEntries?.some((entry) => isSystemRebootMetaEntry(entry)) ?? false)) return;
+  const hostEntry = metaEntries?.find((entry) => isSystemHostMetaEntry(entry));
+  if (hostEntry != null) {
+    ssh.updateHost(hostEntry.host);
+  }
+  try {
+    await ssh.reconnect();
+  } catch (error) {
+    console.error(`Failed to reconnect after reboot: ${String(error)}`);
+    throw error;
+  }
+}
+async function applyRunnerControlPlaneMeta(ssh, step) {
+  if (step.meta == null) return;
+  assertValidModuleMetaEntries(step.meta);
+  await handlePortChange(ssh, step.meta);
+  await handleReboot(ssh, step.meta);
+}
+async function handleMetaAndBuildResult(ssh, environment, result) {
+  let currentEnvironment = environment;
+  if (result.meta != null) {
+    currentEnvironment = await mergeEnvironmentFromMeta(currentEnvironment, result.meta);
+    await applyRunnerControlPlaneMeta(ssh, { meta: result.meta });
+  }
+  return {
+    env: currentEnvironment,
+    flushSignals: result._flushSignals,
+    shouldBreak: shouldBreakAfterResult(result),
+    status: result.status,
+    stopRun: result._stopRun
+  };
+}
+async function runDryRunRecipeModule(recipeModule, environment, ssh, verbose) {
+  return dryRunRecipeModule({
+    environment,
+    options: { verbose },
+    recipeModule,
+    ssh
+  });
+}
+async function runRecipeModule(recipeModule, environment, ssh, stats, verbose, dryRun, shutdownSignal) {
+  try {
+    if (dryRun) return await runDryRunRecipeModule(recipeModule, environment, ssh, verbose);
+    startModuleSpinner(recipeModule.name);
+    const checkResult = await recipeModule.check(ssh, environment);
+    if (checkResult === "ok") {
+      printModuleResult(recipeModule.name, "ok");
+      return { env: environment, shouldBreak: false, status: "ok" };
+    }
+    const result = await recipeModule.apply(ssh, environment, {
+      onChildStep: async (step) => {
+        await applyRunnerControlPlaneMeta(ssh, step);
+      },
+      onSignalStep: async (step) => {
+        await applyRunnerControlPlaneMeta(ssh, step);
+      },
+      shutdownSignal,
+      signalHooks: {
+        onSignalFinished: (status) => {
+          stats.update(status);
+        },
+        onSignalStarted: () => {
+          stats.incrementSignals();
+        }
+      },
+      verbose
+    });
+    return await handleMetaAndBuildResult(ssh, environment, result);
+  } catch (error) {
+    return handleCaughtStepError({
+      environment,
+      error,
+      moduleName: recipeModule.name,
+      shutdownSignal,
+      verbose
+    });
+  }
+}
+async function applyModule(parameters) {
+  const { currentEnvironment, dryRun = false, ssh, targetModule, verbose } = parameters;
+  const connection = targetModule.local === true ? null : ssh;
+  const result = dryRun && targetModule._applyDryRun != null ? await targetModule._applyDryRun(connection, currentEnvironment) : await targetModule.apply(connection, currentEnvironment);
+  const stepResult = await handleMetaAndBuildResult(ssh, currentEnvironment, result);
+  const detail = dryRun ? result._dryRunDetail ?? "(dry-run)" : void 0;
+  printModuleResult(targetModule.name, result.status, detail);
+  if (result.status === "failed" && result.error != null) {
+    printCommandFailure(result.error, verbose);
+  }
+  return stepResult;
+}
+async function checkRegularModule(parameters) {
+  const { env, ssh, targetModule } = parameters;
+  const connection = targetModule.local === true ? null : ssh;
+  startModuleSpinner(targetModule.name);
+  return targetModule.check(connection, env);
+}
+function buildDryRunChangedResult(environment) {
+  return { env: environment, shouldBreak: false, status: "changed" };
+}
+async function runRegularModule(parameters) {
+  const { dryRun, env, ssh, targetModule, verbose } = parameters;
+  const shutdownSignal = parameters.shutdownSignal;
+  try {
+    const checkResult = await checkRegularModule({ env, ssh, targetModule });
+    if (checkResult === "ok") {
+      printModuleResult(targetModule.name, "ok");
+      return { env, shouldBreak: false, status: "ok" };
+    }
+    if (dryRun) {
+      if (shouldExecuteApplyDuringDryRun2(targetModule)) {
+        return await applyCheckedModule({
+          currentEnvironment: env,
+          dryRun: true,
+          shutdownSignal,
+          ssh,
+          targetModule,
+          verbose
+        });
+      }
+      printModuleResult(targetModule.name, "changed", "(dry-run)");
+      return buildDryRunChangedResult(env);
+    }
+    return await applyCheckedModule({
+      currentEnvironment: env,
+      dryRun: false,
+      shutdownSignal,
+      ssh,
+      targetModule,
+      verbose
+    });
+  } catch (error) {
+    return handleCaughtStepError({
+      environment: env,
+      error,
+      moduleName: targetModule.name,
+      shutdownSignal,
+      verbose
+    });
+  }
+}
+function updateLoopSignalState(input) {
+  if (input.result.status == null) return input.currentSignalsPending;
+  input.stats.update(input.result.status);
+  return input.result.status === "changed" ? true : input.currentSignalsPending;
+}
+function shouldFlushTopLevelSignals(input) {
+  return input.stepResult.flushSignals === true && !input.dryRun && input.shutdownSignal() == null && input.signalsPending && input.stats.failed === 0 && input.definitionSignals != null;
+}
+async function flushPendingTopLevelSignals(input) {
+  return runSignals({
+    env: input.currentEnvironment,
+    shutdownSignal: input.shutdownSignal,
+    signals: input.definitionSignals,
+    ssh: input.ssh,
+    stats: input.stats,
+    verbose: input.verbose
+  });
+}
+function applyLoopResultToState(state, result, stats) {
+  return {
+    currentEnvironment: result.env,
+    signalsPending: updateLoopSignalState({
+      currentSignalsPending: state.signalsPending,
+      result,
+      stats
+    }),
+    stopRun: result.stopRun === true ? true : state.stopRun
+  };
+}
+async function flushTopLevelSignalsIfRequested(parameters) {
+  if (!shouldFlushTopLevelSignals({
+    definitionSignals: parameters.definitionSignals,
+    dryRun: parameters.dryRun,
+    shutdownSignal: parameters.shutdownSignal,
+    signalsPending: parameters.loopState.signalsPending,
+    stats: parameters.stats,
+    stepResult: parameters.result
+  })) {
+    return { nextSignalsPending: parameters.loopState.signalsPending, outcome: "continue" };
+  }
+  const definitionSignals = parameters.definitionSignals;
+  if (definitionSignals == null) {
+    return { nextSignalsPending: parameters.loopState.signalsPending, outcome: "continue" };
+  }
+  const signalStatus = await flushPendingTopLevelSignals({
+    currentEnvironment: parameters.loopState.currentEnvironment,
+    definitionSignals,
+    shutdownSignal: parameters.shutdownSignal,
+    ssh: parameters.ssh,
+    stats: parameters.stats,
+    verbose: parameters.verbose
+  });
+  return {
+    nextSignalsPending: false,
+    outcome: signalStatus === "failed" ? "break" : "continue"
+  };
+}
+async function createModuleStepPromise(parameters) {
+  const { currentEnvironment, currentModule, dryRun, shutdownSignal, ssh, stats, verbose } = parameters;
+  return isRecipe(currentModule) ? runRecipeModule(
+    currentModule,
+    currentEnvironment,
+    ssh,
+    stats,
+    verbose,
+    dryRun,
+    shutdownSignal
+  ) : runRegularModule({
+    dryRun,
+    env: currentEnvironment,
+    shutdownSignal,
+    ssh,
+    targetModule: currentModule,
+    verbose
+  });
+}
+async function runModuleLoop(parameters) {
+  const { definitionSignals, dryRun, modules, shutdownSignal, ssh, stats, verbose } = parameters;
+  const loopState = {
+    currentEnvironment: parameters.env,
+    signalsPending: false,
+    stopRun: void 0
+  };
+  for (const currentModule of modules) {
+    if (shutdownSignal() != null) break;
+    const stepPromise = createModuleStepPromise({
+      currentEnvironment: loopState.currentEnvironment,
+      currentModule,
+      dryRun,
+      shutdownSignal,
+      ssh,
+      stats,
+      verbose
+    });
+    const result = await stepPromise;
+    Object.assign(loopState, applyLoopResultToState(loopState, result, stats));
+    const flushResult = await flushTopLevelSignalsIfRequested({
+      definitionSignals,
+      dryRun,
+      loopState,
+      result,
+      shutdownSignal,
+      ssh,
+      stats,
+      verbose
+    });
+    loopState.signalsPending = flushResult.nextSignalsPending;
+    if (flushResult.outcome === "break") break;
+    if (result.shouldBreak) break;
+  }
+  return {
+    env: loopState.currentEnvironment,
+    signalsPending: loopState.signalsPending,
+    stopRun: loopState.stopRun
+  };
+}
+async function runSignals(parameters) {
+  const { env, shutdownSignal, signals, ssh, stats, verbose } = parameters;
+  return runSignalModules({
+    environment: env,
+    hooks: {
+      onSignalFinished: (status) => {
+        stats.update(status);
+      },
+      onSignalStarted: () => {
+        stats.incrementSignals();
+      }
+    },
+    onSignalStep: async (step) => {
+      await applyRunnerControlPlaneMeta(ssh, step);
+    },
+    shutdownSignal,
+    signals,
+    ssh,
+    verbose
+  });
+}
+function throwIfShutdownRequested(shutdownSignal) {
+  const signal = shutdownSignal();
+  if (signal == null) return;
+  throw new Error(`Bootstrap interrupted by ${signal}`);
+}
+async function connectAndRegister(parameters) {
+  const { definition, options, promptAbortSignal, setSsh, shutdownSignal } = parameters;
+  const sshConfig = {
+    ...definition.ssh,
+    ports: [...definition.ssh.ports],
+    ...options.reconnectTimeout == null ? {} : { reconnectTimeout: options.reconnectTimeout }
+  };
+  const ssh = new SshConnectionImpl(definition.host, sshConfig);
+  setSsh(ssh);
+  throwIfShutdownRequested(shutdownSignal);
+  await ssh.connect({ abortSignal: promptAbortSignal });
+  throwIfShutdownRequested(shutdownSignal);
+  return ssh;
+}
+async function executeRun(parameters) {
+  const { definition, dryRun, environment, shutdownSignal, ssh, stats, verbose } = parameters;
+  printRecipeHeader(definition.name);
+  const loopResult = await runModuleLoop({
+    definitionSignals: definition.signals,
+    dryRun,
+    env: environment,
+    modules: definition.run,
+    shutdownSignal,
+    ssh,
+    stats,
+    verbose
+  });
+  const finalEnvironment = loopResult.env;
+  if (!dryRun && shutdownSignal() == null && loopResult.signalsPending && stats.failed === 0 && definition.signals != null)
+    await runSignals({
+      env: finalEnvironment,
+      shutdownSignal,
+      signals: definition.signals,
+      ssh,
+      stats,
+      verbose
+    });
+  printSummary(stats);
+}
+function rethrowIfNotShutdown(error, shutdownSignal) {
+  if (shutdownSignal() == null) throw error;
+}
+async function runPlaybook(definition, options = {}) {
+  const { dryRun = false, verbose = false } = options;
+  const environment = await initializeEnvironment(options, definition);
+  const { handleShutdownSignal, promptAbortSignal, setSsh, shutdownSignal } = setupShutdownHandlers();
+  const stats = new RunStats();
+  let ssh;
+  printRunContext({
+    dryRun,
+    host: definition.host,
+    name: definition.name,
+    ports: definition.ssh.ports
+  });
+  try {
+    ssh = await connectAndRegister({
+      definition,
+      options,
+      promptAbortSignal,
+      setSsh,
+      shutdownSignal
+    });
+    await executeRun({ definition, dryRun, environment, shutdownSignal, ssh, stats, verbose });
+  } catch (error) {
+    rethrowIfNotShutdown(error, shutdownSignal);
+  } finally {
+    for (const signal of ["SIGINT", "SIGTERM"])
+      process.removeListener(signal, handleShutdownSignal);
+    ssh?.disconnect();
+  }
+  resolveExitCode(shutdownSignal(), stats);
+}
+
+// src/cli.ts
+var SECONDS_TO_MS = 1e3;
+var DEFAULT_RECONNECT_TIMEOUT_SECONDS = 300;
+var ENVIRONMENT_KEY_PATTERN = new RegExp("^[A-Za-z_]\\w*$", "v");
+var FIRST_RUN_ENV_NAME = "PARATIX_FIRST_RUN";
+function isServerDefinitionLike(value) {
+  return collectDefinitionErrors(value).length === 0;
+}
+function collectStringErrors(object, check, errors) {
+  const name = check.label ?? check.key;
+  if (!(check.key in object)) {
+    errors.push(`Missing property '${name}' (expected string)`);
+  } else if (typeof object[check.key] !== "string") {
+    errors.push(`Invalid property '${name}' (expected string, got ${typeof object[check.key]})`);
+  } else if (object[check.key].length === 0) {
+    errors.push(`Property '${name}' must not be empty`);
+  }
+}
+function collectArrayErrors(object, check, errors) {
+  const name = check.label ?? check.key;
+  if (!(check.key in object)) {
+    errors.push(`Missing property '${name}' (expected array)`);
+  } else if (!Array.isArray(object[check.key])) {
+    errors.push(`Invalid property '${name}' (expected array, got ${typeof object[check.key]})`);
+  } else if (object[check.key].length === 0) {
+    errors.push(`Property '${name}' must not be empty`);
+  }
+}
+function collectSshErrors(value, errors) {
+  if (!("ssh" in value)) {
+    errors.push("Missing property 'ssh' (expected object)");
+    return;
+  }
+  errors.push(...collectSshConfigErrors(value.ssh));
+}
+function collectDefinitionErrors(value) {
+  const errors = [];
+  if (typeof value !== "object" || value === null) {
+    errors.push("Export is not an object");
+    return errors;
+  }
+  const object = value;
+  collectStringErrors(object, { key: "name" }, errors);
+  collectStringErrors(object, { key: "host" }, errors);
+  collectSshErrors(object, errors);
+  collectArrayErrors(object, { key: "run" }, errors);
+  return errors;
+}
+function validateServerDefinition(value, file) {
+  if (isServerDefinitionLike(value)) {
+    return;
+  }
+  const errors = collectDefinitionErrors(value);
+  const details = errors.map((entry) => `  - ${entry}`).join("\n");
+  console.error(
+    `Error: ${file} does not export a valid ServerDefinition.
+${details}
+  Use the server() helper to create a valid definition.`
+  );
+  process.exit(2);
+}
+function errorToString(value) {
+  if (value instanceof Error) return value.message;
+  if (typeof value === "object" && value !== null) {
+    try {
+      return JSON.stringify(value);
+    } catch {
+      return inspect(value, { breakLength: Infinity, depth: 5 });
+    }
+  }
+  return String(value);
+}
+function printCauseChain(error) {
+  let cause = error.cause;
+  while (cause != null) {
+    console.error(`  Caused by: ${errorToString(cause)}`);
+    cause = cause instanceof Error ? cause.cause : void 0;
+  }
+}
+function printExceptionError(error, verbose) {
+  console.error(`Error: ${errorToString(error)}`);
+  if (error instanceof Error) {
+    printCauseChain(error);
+    if (verbose && error.stack != null) {
+      console.error(`
+${error.stack}`);
+    }
+  }
+}
+function handleTsxLoadFailure(filePath) {
+  if (new RegExp("\\.[cm]?ts$", "v").test(filePath)) {
+    console.error(
+      `${pc.red("Error:")} tsx is required to run TypeScript playbooks but could not be loaded.
+  Install it with: ${pc.bold("npm install -g tsx")} or add it as a devDependency.`
+    );
+    process.exit(2);
+  }
+}
+function isDirectCliExecution(moduleUrl, candidateEntryScript) {
+  if (candidateEntryScript == null) {
+    return false;
+  }
+  return realpathSync(fileURLToPath(moduleUrl)) === realpathSync(candidateEntryScript);
+}
+function applyCliEnvironmentOverrides(environment, options) {
+  if (!options.firstRun) return environment;
+  return { ...environment, [FIRST_RUN_ENV_NAME]: "true" };
+}
+function applyCliProcessEnvironment(options) {
+  if (!options.firstRun) return;
+  process.env[FIRST_RUN_ENV_NAME] = "true";
+}
+async function loadServerDefinitionFromFile(file, options) {
+  const filePath = resolve(file);
+  const fileUrl = pathToFileURL(filePath).href;
+  applyCliProcessEnvironment(options);
+  await import("tsx/esm/api").then((tsx) => {
+    tsx.register();
+  }).catch(() => {
+    handleTsxLoadFailure(filePath);
+  });
+  const imported = await import(fileUrl);
+  const definition = imported.default ?? imported;
+  validateServerDefinition(definition, filePath);
+  return definition;
+}
+var program = new Command();
+program.name("paratix").description("Idempotent VPS setup tool in TypeScript").version("0.1.0");
+program.command("apply <file>").description("Apply a server definition").option(
+  "--dry-run",
+  "Only check, do not apply. Some modules validate prospective config but cannot verify runtime restarts.",
+  false
+).option("--env <key=value...>", "Set env values", collectEnvironment, {}).option("--env-file <path>", "Load dotenv file").option("--first-run", "Set PARATIX_FIRST_RUN=true before loading the playbook", false).option(
+  "--reconnect-timeout <seconds>",
+  "SSH reconnect timeout",
+  parsePositiveNumber,
+  DEFAULT_RECONNECT_TIMEOUT_SECONDS
+).option("--verbose", "Show full stack traces on error", false).action(async (file, options) => {
+  try {
+    printCliHeader("0.1.0");
+    const environmentOverrides = applyCliEnvironmentOverrides(
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      options.env,
+      {
+        // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+        firstRun: options.firstRun
+      }
+    );
+    const definition = await loadServerDefinitionFromFile(file, {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      firstRun: options.firstRun
+    });
+    await runPlaybook(definition, {
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      dryRun: options.dryRun,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      envFile: options.envFile,
+      envOverrides: environmentOverrides,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      reconnectTimeout: options.reconnectTimeout * SECONDS_TO_MS,
+      // eslint-disable-next-line @typescript-eslint/no-unsafe-type-assertion -- Commander options typed as Record<string, unknown>
+      verbose: options.verbose
+    });
+  } catch (error) {
+    printExceptionError(error, options.verbose);
+    process.exit(process.exitCode ?? 2);
+  }
+});
+function parsePositiveNumber(value) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    console.error(`Invalid --reconnect-timeout value: ${value} (expected a positive number)`);
+    process.exit(2);
+  }
+  return parsed;
+}
+function collectEnvironment(value, previous) {
+  const eqIndex = value.indexOf("=");
+  if (eqIndex === -1) {
+    console.error(`Invalid --env format: ${value} (expected key=value)`);
+    process.exit(2);
+  }
+  const key = value.slice(0, eqIndex);
+  const value_ = value.slice(eqIndex + 1);
+  if (!ENVIRONMENT_KEY_PATTERN.test(key)) {
+    console.error(
+      `Invalid --env name: ${key === "" ? "(empty)" : key} (expected [A-Za-z_][A-Za-z0-9_]*)`
+    );
+    process.exit(2);
+  }
+  return { ...previous, [key]: value_ };
+}
+var entryScript = process.argv[1];
+if (isDirectCliExecution(import.meta.url, entryScript)) {
+  await program.parseAsync();
+}
+export {
+  applyCliEnvironmentOverrides,
+  applyCliProcessEnvironment,
+  collectDefinitionErrors,
+  collectEnvironment,
+  handleTsxLoadFailure,
+  isDirectCliExecution,
+  isServerDefinitionLike,
+  loadServerDefinitionFromFile,
+  parsePositiveNumber,
+  printExceptionError
+};
+//# sourceMappingURL=cli.js.map