redkite 0.1.6

package/bin/redkite.mjs

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import { main } from "../dist/cli/index.js";
+
+// Node warns about a .ts config in a CommonJS package before redkite gets to say
+// the same thing usefully, and its advice, .mjs, is wrong for a TypeScript file
+process.removeAllListeners("warning");
+process.on("warning", (warning) => {
+  if (warning.message.startsWith("Failed to load the ES module")) return;
+  console.warn(`${warning.name}: ${warning.message}`);
+});
+
+await main(process.argv.slice(2));

package/dist/build.d.ts

@@ -0,0 +1,27 @@
+import type { Docker } from "./docker.js";
+import type { Host } from "./host.js";
+import type { AppTopology } from "./topology.js";
+import type { AppSpec } from "./types.js";
+export type BuildContext = {
+    host: Host;
+    docker: Docker;
+    deliver?: {
+        host: Host;
+        docker: Docker;
+    };
+    env: string;
+    files: Record<string, string>;
+    branch: string;
+    environment: string;
+    detail?: (message: string) => void;
+    output?: (line: string) => void;
+};
+export type BuildResult = {
+    release: string;
+    fingerprint: string;
+    tag: string;
+    builderTag: string;
+    cached: boolean;
+};
+export declare function build(app: AppSpec, topology: AppTopology, context: BuildContext): Promise<BuildResult>;
+//# sourceMappingURL=build.d.ts.map

package/dist/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAM1C,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,IAAI,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IAGf,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAEzC,GAAG,EAAE,MAAM,CAAC;IAEZ,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAEnC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACjC,CAAC;AAOF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAEhB,WAAW,EAAE,MAAM,CAAC;IAEpB,GAAG,EAAE,MAAM,CAAC;IAIZ,UAAU,EAAE,MAAM,CAAC;IAEnB,MAAM,EAAE,OAAO,CAAC;CACjB,CAAC;AAEF,wBAAsB,KAAK,CACzB,GAAG,EAAE,OAAO,EACZ,QAAQ,EAAE,WAAW,EACrB,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC,WAAW,CAAC,CAuFtB"}

package/dist/build.js

@@ -0,0 +1,132 @@
+import { createHash } from "node:crypto";
+import { resolve } from "node:path";
+import { BUILDER_STAGE, renderDockerfile, renderDockerignore } from "./dockerfile.js";
+import { prepareSource } from "./source.js";
+// Bumped when the pipeline changes shape without the config changing. The tag
+// below is what tells a host it already holds an image, and a host that trusts
+// the commit alone serves the last pipeline's output forever
+const PIPELINE = "4";
+export async function build(app, topology, context) {
+    const { host, docker } = context;
+    const spec = app.build;
+    const detail = context.detail ?? (() => { });
+    const source = await prepareSource(host, {
+        name: topology.container,
+        repo: app.repo,
+        // Already absolute when the CLI loaded the config, because a path is read
+        // against the deployment file rather than wherever this was run
+        path: app.path && resolve(app.path),
+        include: app.include,
+        branch: context.branch,
+        submodules: spec.submodules,
+        detail,
+    });
+    const release = source.release;
+    const fingerprint = fingerprintOf(app, context, release);
+    const tag = `${topology.container}:${release}-${fingerprint}`;
+    // Always, rather than where something remembered to ask for it. It costs the
+    // export of layers the runtime build produced anyway, and a flag that has to
+    // be set before a step can run is a flag that will be missing
+    const builderTag = `${topology.container}-builder:${release}-${fingerprint}`;
+    // Asked of the daemon that will run the container, not the one that builds.
+    // An image this machine holds and the host does not is one still to be sent
+    const runner = context.deliver?.docker ?? docker;
+    // The whole build is skipped, not just a transfer. Nothing about this commit,
+    // this pipeline or these secrets differs from the image already sitting there
+    if (await held(runner, tag, builderTag)) {
+        detail(`already built at ${release.slice(0, 7)}`);
+        await runner.image.retag(tag, topology.container);
+        return { release, fingerprint, tag, builderTag, cached: true };
+    }
+    const secrets = await writeSecrets(app, context, fingerprint);
+    const dockerfile = await host.write(`${app.name}.Dockerfile`, renderDockerfile(spec, {
+        caches: topology.caches,
+        port: topology.port,
+        release,
+        environment: context.environment,
+        envSecret: secrets.env.id,
+        fileSecrets: Object.fromEntries(secrets.files.map((file) => [file.path, file.id])),
+        dir: app.dir,
+    }));
+    // BuildKit reads this beside the Dockerfile rather than inside the context,
+    // which is what lets the checkout stay a checkout: the repository keeps its
+    // own .dockerignore, and .git never enters the build
+    await host.write(`${app.name}.Dockerfile.dockerignore`, renderDockerignore(app.include));
+    const invocation = {
+        context: source.tree,
+        dockerfile,
+        secrets: Object.fromEntries([secrets.env, ...secrets.files].map((secret) => [secret.id, secret.src])),
+    };
+    detail(`building ${release.slice(0, 7)}`);
+    await docker.image.build({ ...invocation, tags: [tag, topology.container] }, watch(detail, context.output));
+    // Every layer of this was just built, so it costs the export alone
+    detail("keeping the builder");
+    await docker.image.build({ ...invocation, tags: [builderTag], target: BUILDER_STAGE }, watch(detail, context.output));
+    await ship(context, [tag, topology.container, builderTag], detail);
+    return { release, fingerprint, tag, builderTag, cached: false };
+}
+// One stream, rather than a tarball written here, copied, and read there. The
+// tags travel inside the archive, so nothing has to be named again on arrival
+async function ship(context, tags, detail) {
+    const deliver = context.deliver;
+    if (!deliver)
+        return;
+    const named = tags.filter((tag) => tag !== undefined);
+    detail(`shipping ${named.length} images`);
+    const result = await deliver.host.pipe(`docker save ${named.join(" ")}`, "docker load", context.output);
+    if (result.code !== 0) {
+        throw new Error(`Could not ship the image: ${result.stderr || result.stdout}`);
+    }
+    await deliver.docker.track((state) => {
+        for (const tag of named)
+            state.images.add(tag);
+    });
+}
+async function held(docker, tag, builderTag) {
+    if (!(await docker.image.exists(tag)))
+        return false;
+    // A runtime image without the builder that produced it would run the
+    // migration from whatever release happened to be tagged last
+    return await docker.image.exists(builderTag);
+}
+// The fingerprint is part of every id, because a secret mount is not part of a
+// layer's cache key. Without it a changed environment file is answered with the
+// image that was built from the old one
+async function writeSecrets(app, context, fingerprint) {
+    const env = {
+        id: `${app.name}-env-${fingerprint}`,
+        src: await context.host.write(`${app.name}.env`, context.env),
+    };
+    const files = await Promise.all(Object.entries(context.files).map(async ([path, contents], index) => ({
+        path,
+        id: `${app.name}-file-${index}-${fingerprint}`,
+        // Named by index, so a container path with slashes in it stays one file
+        src: await context.host.write(`${app.name}.file.${index}`, contents),
+    })));
+    return { env, files };
+}
+// BuildKit names the step it is on in its own progress output, which is a
+// better line to show than anything this file could invent
+const STEP = /^#\d+ \[[^\]]*\] (.+)$/;
+function watch(detail, output) {
+    return (line) => {
+        output?.(line);
+        const step = STEP.exec(line)?.[1];
+        if (step)
+            detail(step);
+    };
+}
+// The commit is one input of several. The pipeline, the environment file and
+// any credential baked in as a file all change the image without touching it
+function fingerprintOf(app, context, release) {
+    return createHash("sha256")
+        .update(PIPELINE)
+        .update(release)
+        .update(app.dir ?? "")
+        .update(JSON.stringify(app.build))
+        .update(context.env)
+        .update(JSON.stringify(Object.entries(context.files).sort()))
+        .digest("hex")
+        .slice(0, 12);
+}
+//# sourceMappingURL=build.js.map

package/dist/build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.js","sourceRoot":"","sources":["../src/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAyB5C,8EAA8E;AAC9E,+EAA+E;AAC/E,6DAA6D;AAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC;AAgBrB,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,GAAY,EACZ,QAAqB,EACrB,OAAqB;IAErB,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACjC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;IACvB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAE5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE;QACvC,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,0EAA0E;QAC1E,gEAAgE;QAChE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QACnC,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM;KACP,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IAC/B,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,OAAO,IAAI,WAAW,EAAE,CAAC;IAC9D,6EAA6E;IAC7E,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,GAAG,QAAQ,CAAC,SAAS,YAAY,OAAO,IAAI,WAAW,EAAE,CAAC;IAE7E,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,MAAM,IAAI,MAAM,CAAC;IAEjD,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,oBAAoB,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC;QAElD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAE9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,KAAK,CACjC,GAAG,GAAG,CAAC,IAAI,aAAa,EACxB,gBAAgB,CAAC,IAAI,EAAE;QACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,OAAO;QACP,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW,CAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAClD;QACD,GAAG,EAAE,GAAG,CAAC,GAAG;KACb,CAAC,CACH,CAAC;IAEF,4EAA4E;IAC5E,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,IAAI,CAAC,KAAK,CACd,GAAG,GAAG,CAAC,IAAI,0BAA0B,EACrC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAChC,CAAC;IAEF,MAAM,UAAU,GAAG;QACjB,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,UAAU;QACV,OAAO,EAAE,MAAM,CAAC,WAAW,CACzB,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CACzE;KACF,CAAC;IAEF,MAAM,CAAC,YAAY,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CACtB,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAClD,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAC9B,CAAC;IAEF,mEAAmE;IACnE,MAAM,CAAC,qBAAqB,CAAC,CAAC;IAC9B,MAAM,MAAM,CAAC,KAAK,CAAC,KAAK,CACtB,EAAE,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,EAC5D,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAC9B,CAAC;IAEF,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;IAEnE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,KAAK,UAAU,IAAI,CACjB,OAAqB,EACrB,IAA4B,EAC5B,MAAiC;IAEjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO;QAAE,OAAO;IAErB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC;IACtD,MAAM,CAAC,YAAY,KAAK,CAAC,MAAM,SAAS,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CACpC,eAAe,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAChC,aAAa,EACb,OAAO,CAAC,MAAM,CACf,CAAC;IAEF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,KAAK,MAAM,GAAG,IAAI,KAAK;YAAE,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,GAAW,EAAE,UAAkB;IACjE,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,qEAAqE;IACrE,6DAA6D;IAC7D,OAAO,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAQD,+EAA+E;AAC/E,gFAAgF;AAChF,wCAAwC;AACxC,KAAK,UAAU,YAAY,CACzB,GAAY,EACZ,OAAqB,EACrB,WAAmB;IAEnB,MAAM,GAAG,GAAG;QACV,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,QAAQ,WAAW,EAAE;QACpC,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC;KAC9D,CAAC;IAEF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACpE,IAAI;QACJ,EAAE,EAAE,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,IAAI,WAAW,EAAE;QAC9C,wEAAwE;QACxE,GAAG,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,IAAI,SAAS,KAAK,EAAE,EAAE,QAAQ,CAAC;KACrE,CAAC,CAAC,CACJ,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,0EAA0E;AAC1E,2DAA2D;AAC3D,MAAM,IAAI,GAAG,wBAAwB,CAAC;AAEtC,SAAS,KAAK,CAAC,MAAiC,EAAE,MAA+B;IAC/E,OAAO,CAAC,IAAY,EAAE,EAAE;QACtB,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;QAEf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,SAAS,aAAa,CAAC,GAAY,EAAE,OAAqB,EAAE,OAAe;IACzE,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,QAAQ,CAAC;SAChB,MAAM,CAAC,OAAO,CAAC;SACf,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;SACrB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;SACjC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACnB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC5D,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAClB,CAAC"}

package/dist/checks.d.ts

@@ -0,0 +1,4 @@
+import type { Built, Context, Plan, Released } from "./pipeline.js";
+export declare function runChecks(input: Built, context: Context): Promise<Released>;
+export declare function assertCheckable(plan: Plan): void;
+//# sourceMappingURL=checks.d.ts.map

package/dist/checks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.d.ts","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAapE,wBAAsB,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAajF;AA8BD,wBAAgB,eAAe,CAAC,IAAI,EAAE,IAAI,QAOzC"}

package/dist/checks.js

@@ -0,0 +1,49 @@
+import { appRoot } from "./layout.js";
+import { quote } from "./shell.js";
+import { attachment, builderOf } from "./steps.js";
+// What redkite's verify step runs. An app declares the commands that decide
+// whether its build works, and this is the whole of putting them somewhere they
+// can reach the services the deployment brought up.
+//
+// The image is the builder rather than the runtime one. The runtime image holds
+// the compiled output and nothing that compiled it, so the test runner is not
+// in there, and installing one at check time would test a different tree.
+export async function runChecks(input, context) {
+    const checked = [];
+    for (const app of context.config.apps) {
+        if (!app.verify)
+            continue;
+        await checkApp(app, app.verify, input, context);
+        checked.push(app.name);
+    }
+    // Anything that got here passed: a failing command throws. The lists a swap
+    // fills stay empty, because a verify run moves no addresses
+    return { ...input, ok: true, released: [], reverted: [], checked };
+}
+async function checkApp(app, spec, input, context) {
+    const flags = [
+        "run --rm",
+        ...attachment(spec.network ?? "deployment", context.topology),
+        `--workdir ${appRoot(app.dir)}`,
+        ...settings({ ...app.environment, ...spec.environment }),
+        builderOf(input, app.name),
+    ];
+    // In order and one at a time. The first is usually what brings the database
+    // to the schema the rest expect, so running them together would race
+    for (const command of spec.steps) {
+        context.task.detail(`${app.name}: ${command}`);
+        await context.docker.runOrThrow([...flags, "sh -c", quote(command)].join(" "), `${app.name} failed ${command}`, context.task.line);
+    }
+}
+function settings(environment) {
+    return Object.entries(environment).map(([name, value]) => `-e ${name}=${quote(value)}`);
+}
+// Checked before the run starts, so asking for a verify that would check
+// nothing fails without having created a network or built an image
+export function assertCheckable(plan) {
+    if (plan.config.apps.some((app) => app.verify))
+        return;
+    throw new Error("No app declares verify, so this run would check nothing. " +
+        "An app is verified by giving it verify: { steps: [...] }");
+}
+//# sourceMappingURL=checks.js.map

package/dist/checks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checks.js","sourceRoot":"","sources":["../src/checks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEtC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAGnD,4EAA4E;AAC5E,gFAAgF;AAChF,oDAAoD;AACpD,EAAE;AACF,gFAAgF;AAChF,8EAA8E;AAC9E,0EAA0E;AAE1E,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAY,EAAE,OAAgB;IAC5D,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,SAAS;QAE1B,MAAM,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,4EAA4E;IAC5E,4DAA4D;IAC5D,OAAO,EAAE,GAAG,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,IAAgB,EAAE,KAAY,EAAE,OAAgB;IACpF,MAAM,KAAK,GAAG;QACZ,UAAU;QACV,GAAG,UAAU,CAAC,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC7D,aAAa,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE;QAC/B,GAAG,QAAQ,CAAC,EAAE,GAAG,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACxD,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC;KAC3B,CAAC;IAEF,4EAA4E;IAC5E,qEAAqE;IACrE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QAE/C,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAC7B,CAAC,GAAG,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAC7C,GAAG,GAAG,CAAC,IAAI,WAAW,OAAO,EAAE,EAC/B,OAAO,CAAC,IAAI,CAAC,IAAI,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,WAAmC;IACnD,OAAO,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,IAAU;IACxC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,OAAO;IAEvD,MAAM,IAAI,KAAK,CACb,2DAA2D;QACzD,0DAA0D,CAC7D,CAAC;AACJ,CAAC"}

package/dist/cli/agent.d.ts

@@ -0,0 +1,2 @@
+export declare function requireAgent(warn: (message: string) => void): string;
+//# sourceMappingURL=agent.d.ts.map

package/dist/cli/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../../src/cli/agent.ts"],"names":[],"mappings":"AAQA,wBAAgB,YAAY,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,UAmB3D"}

package/dist/cli/agent.js

@@ -0,0 +1,24 @@
+import { execFileSync } from "node:child_process";
+// Cloning private repositories and opening the tunnel both go through the
+// agent, so a deploy without one fails halfway rather than at the start
+// A plain writer rather than a Log, because this runs before the view opens:
+// ssh-add may ask for a passphrase, and it cannot ask through a screen
+// something else is drawing
+export function requireAgent(warn) {
+    const existing = process.env["SSH_AUTH_SOCK"];
+    if (existing)
+        return existing;
+    warn("No SSH agent, starting one");
+    const output = execFileSync("ssh-agent", ["-s"], { encoding: "utf8" });
+    const socket = output.match(/SSH_AUTH_SOCK=([^;]+);/)?.[1];
+    const pid = output.match(/SSH_AGENT_PID=([^;]+);/)?.[1];
+    if (!socket)
+        throw new Error("ssh-agent did not report a socket");
+    process.env["SSH_AUTH_SOCK"] = socket;
+    if (pid)
+        process.env["SSH_AGENT_PID"] = pid;
+    // Inherits stdio so a passphrase prompt reaches the person running this
+    execFileSync("ssh-add", [], { stdio: "inherit" });
+    return socket;
+}
+//# sourceMappingURL=agent.js.map

package/dist/cli/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../../src/cli/agent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,0EAA0E;AAC1E,wEAAwE;AAExE,6EAA6E;AAC7E,uEAAuE;AACvE,4BAA4B;AAC5B,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAExD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAElE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,MAAM,CAAC;IACtC,IAAI,GAAG;QAAE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC;IAE5C,wEAAwE;IACxE,YAAY,CAAC,SAAS,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAElD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/cli/config.d.ts

@@ -0,0 +1,5 @@
+import type { Deployment, Environment } from "../types.js";
+export declare function loadConfig(explicit?: string): Promise<Deployment>;
+export declare function discover(from: string): string;
+export declare function loadEnvironments(directory: string): Promise<Record<string, Environment>>;
+//# sourceMappingURL=config.d.ts.map

package/dist/cli/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AA2B3D,wBAAsB,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAiBvE;AA0CD,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAwB7C;AAGD,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,wCAmBvD"}

package/dist/cli/config.js

@@ -0,0 +1,217 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+// Found by convention rather than named on the command line. A repository has
+// one deployment, and requiring the path is a flag nobody ever varies.
+//
+// The environments live beside it, one file each, so the thing that differs
+// between staging and production is a file rather than a key several levels
+// down a literal.
+const EXTENSIONS = ["ts", "mts", "js", "mjs"];
+const CANDIDATES = EXTENSIONS.map((extension) => `redkite.config.${extension}`);
+// redkite.<environment>.config.<extension>, beside the deployment it belongs to
+const PER_ENVIRONMENT = /^redkite\.([a-z0-9-]+)\.config\.(ts|mts|js|mjs)$/;
+// Node strips types itself from 22.18 on, which is what lets redkite ship with
+// no dependencies. These are the ways that can fail on a config it cannot read.
+// A SyntaxError is the same class of failure: a package without "type":
+// "module" makes a .ts file CommonJS, where an import statement is not legal
+const LOADER = new Set([
+    "ERR_UNKNOWN_FILE_EXTENSION",
+    "ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX",
+    "ERR_MODULE_NOT_FOUND",
+    "ERR_INVALID_MODULE_SPECIFIER",
+]);
+export async function loadConfig(explicit) {
+    const path = explicit ? resolve(explicit) : discover(process.cwd());
+    const config = defaultOf(await load(path), path);
+    const beside = await loadEnvironments(dirname(path));
+    const named = await loadNamed(manifestOf(explicit ? dirname(path) : process.cwd()));
+    for (const name of Object.keys(named)) {
+        if (!beside[name])
+            continue;
+        throw new Error(`${name} is named by package.json and also sits beside the deployment. ` +
+            "An environment comes from one place or the other");
+    }
+    return { ...rooted(config, dirname(path)), environments: { ...beside, ...named } };
+}
+// A source path belongs to the file that named it, not to wherever the command
+// was run. Resolving it here is what lets a deploy from a workspace and one
+// from the root build the same tree
+function rooted(config, directory) {
+    if (!config.apps.some((app) => app.path))
+        return config;
+    return {
+        ...config,
+        apps: config.apps.map((app) => app.path ? { ...app, path: resolve(directory, app.path) } : app),
+    };
+}
+// package.json may name the file each environment lives in, for a repository
+// that keeps them somewhere the naming convention would not find them
+async function loadNamed(manifest) {
+    const declared = manifest?.redkite.environments;
+    if (!manifest || !declared)
+        return {};
+    const environments = {};
+    for (const [name, where] of Object.entries(declared)) {
+        if (typeof where !== "string") {
+            throw new Error(`package.json names ${name} as something other than a path`);
+        }
+        const path = resolve(manifest.root, where);
+        if (!existsSync(path)) {
+            throw new Error(`package.json points ${name} at ${path}, which is not there`);
+        }
+        environments[name] = defaultOf(await load(path), path);
+    }
+    return environments;
+}
+// A deployment is one file at the root of the project, and a deploy is as
+// likely to be run from a workspace inside it as from there
+export function discover(from) {
+    let directory = from;
+    for (;;) {
+        const declared = directoryFrom(directory);
+        // Saying where the files are and not putting them there is a mistake worth
+        // stopping for, rather than a reason to keep looking further up
+        if (declared)
+            return found(declared) ?? missing(declared, directory);
+        const here = found(directory);
+        if (here)
+            return here;
+        const parent = dirname(directory);
+        if (parent === directory)
+            break;
+        directory = parent;
+    }
+    throw new Error(`No redkite.config.ts found in ${from} or any directory above it. A deployment ` +
+        'is one file at the root of the project, or wherever package.json\'s ' +
+        '"redkite": { "directory": … } says it is');
+}
+// Every environment that lives in a file of its own, keyed by the name in it
+export async function loadEnvironments(directory) {
+    const environments = {};
+    const seen = {};
+    for (const entry of readdirSync(directory).sort()) {
+        const name = PER_ENVIRONMENT.exec(entry)?.[1];
+        if (!name)
+            continue;
+        const first = seen[name];
+        if (first) {
+            throw new Error(`${name} is defined by both ${first} and ${entry}`);
+        }
+        seen[name] = entry;
+        const path = join(directory, entry);
+        environments[name] = defaultOf(await load(path), path);
+    }
+    return environments;
+}
+function found(directory) {
+    for (const candidate of CANDIDATES) {
+        const path = join(directory, candidate);
+        if (existsSync(path))
+            return path;
+    }
+    return undefined;
+}
+function missing(declared, from) {
+    throw new Error(`${join(from, "package.json")} points redkite at ${declared}, which holds no ` +
+        `redkite.config.${EXTENSIONS.join(", redkite.config.")}`);
+}
+function manifestAt(directory) {
+    const path = join(directory, "package.json");
+    if (!existsSync(path))
+        return undefined;
+    try {
+        const parsed = JSON.parse(readFileSync(path, "utf8"));
+        return parsed.redkite ? { root: directory, redkite: parsed.redkite } : undefined;
+    }
+    catch {
+        // A package.json that does not parse is not this tool's to complain about
+        return undefined;
+    }
+}
+// The nearest one above wherever this was run, which is the same walk the
+// config itself is found by
+function manifestOf(from) {
+    let directory = from;
+    for (;;) {
+        const found = manifestAt(directory);
+        if (found)
+            return found;
+        const parent = dirname(directory);
+        if (parent === directory)
+            return undefined;
+        directory = parent;
+    }
+}
+// package.json says where the deployment files live, for a repository that
+// would rather not keep them at its root
+function directoryFrom(directory) {
+    const declared = manifestAt(directory)?.redkite.directory;
+    return typeof declared === "string" ? resolve(directory, declared) : undefined;
+}
+function defaultOf(module, path) {
+    const found = module;
+    // A config inside a CommonJS package transpiles to CommonJS, and Node hands
+    // back the whole module.exports as the default, wrapping the real one
+    const config = found.default?.default ?? found.default;
+    if (config)
+        return config;
+    throw new Error(`${path} has no default export`);
+}
+async function load(path) {
+    const url = pathToFileURL(path).href;
+    try {
+        return await import(url);
+    }
+    catch (error) {
+        if (!unreadable(error))
+            throw error;
+        // tsx resolves what Node will not: a path mapped by tsconfig, and the
+        // ./thing.js specifier TypeScript writes for a sibling ./thing.ts
+        const register = await tsxFrom(dirname(path));
+        if (!register)
+            throw cannotRead(path, error);
+        const unregister = register();
+        try {
+            return await import(url);
+        }
+        finally {
+            await unregister();
+        }
+    }
+}
+// Resolved from the project being deployed rather than depended on, so redkite
+// installs as one package and still reads a config that needs more
+async function tsxFrom(directory) {
+    try {
+        const require = createRequire(join(directory, "redkite.js"));
+        const api = (await import(pathToFileURL(require.resolve("tsx/esm/api")).href));
+        return api.register;
+    }
+    catch {
+        return undefined;
+    }
+}
+function unreadable(error) {
+    if (!(error instanceof Error))
+        return false;
+    if (error instanceof SyntaxError)
+        return true;
+    return "code" in error && typeof error.code === "string" && LOADER.has(error.code);
+}
+// Node reads TypeScript itself, within limits a config can run into. Each of
+// them has a one line fix, and none of them is obvious from what Node throws
+function cannotRead(path, error) {
+    const remedies = [
+        '  · A package without "type": "module" makes a .ts file CommonJS, where',
+        "    an import statement is not legal. Name it redkite.config.mts instead",
+        "  · Node resolves a relative import by the file it names, so a sibling is",
+        "    ./thing.ts rather than ./thing.js",
+        "  · Node reads TypeScript from 22.18 on, and this is " + process.version,
+        "  · Anything else: add tsx to this project and redkite will read the config",
+        "    through it",
+    ];
+    return new Error(`Could not read ${path}\n\n${error.message}\n\n${remedies.join("\n")}`, { cause: error });
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/cli/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAChE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAIzC,8EAA8E;AAC9E,uEAAuE;AACvE,EAAE;AACF,4EAA4E;AAC5E,4EAA4E;AAC5E,kBAAkB;AAElB,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,CAAU,CAAC;AAEvD,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,SAAS,EAAE,CAAC,CAAC;AAEhF,gFAAgF;AAChF,MAAM,eAAe,GAAG,kDAAkD,CAAC;AAE3E,+EAA+E;AAC/E,gFAAgF;AAChF,wEAAwE;AACxE,6EAA6E;AAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC;IACrB,4BAA4B;IAC5B,mCAAmC;IACnC,sBAAsB;IACtB,8BAA8B;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAiB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACpE,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAe,CAAC;IAE/D,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAEpF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,SAAS;QAE5B,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,iEAAiE;YACtE,kDAAkD,CACrD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,GAAG,MAAM,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AACrF,CAAC;AAED,+EAA+E;AAC/E,4EAA4E;AAC5E,oCAAoC;AACpC,SAAS,MAAM,CAAC,MAAkB,EAAE,SAAiB;IACnD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAExD,OAAO;QACL,GAAG,MAAM;QACT,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC5B,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAChE;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,QAA8B;IACrD,MAAM,QAAQ,GAAG,QAAQ,EAAE,OAAO,CAAC,YAAY,CAAC;IAChD,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEtC,MAAM,YAAY,GAAgC,EAAE,CAAC;IAErD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,iCAAiC,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,OAAO,IAAI,sBAAsB,CAAC,CAAC;QAChF,CAAC;QAED,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAgB,CAAC;IACxE,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,4DAA4D;AAC5D,MAAM,UAAU,QAAQ,CAAC,IAAY;IACnC,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,SAAS,CAAC;QACR,MAAM,QAAQ,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;QAE1C,2EAA2E;QAC3E,gEAAgE;QAChE,IAAI,QAAQ;YAAE,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAErE,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9B,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAEhC,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;IAED,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,2CAA2C;QAC9E,sEAAsE;QACtE,0CAA0C,CAC7C,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,YAAY,GAAgC,EAAE,CAAC;IACrD,MAAM,IAAI,GAA2B,EAAE,CAAC;IAExC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,IAAI;YAAE,SAAS;QAEpB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACzB,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,uBAAuB,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACpC,YAAY,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAgB,CAAC;IACxE,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAS,KAAK,CAAC,SAAiB;IAC9B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACxC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACpC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,QAAgB,EAAE,IAAY;IAC7C,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,sBAAsB,QAAQ,mBAAmB;QAC5E,kBAAkB,UAAU,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAC3D,CAAC;AACJ,CAAC;AASD,SAAS,UAAU,CAAC,SAAiB;IACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAExC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAEnD,CAAC;QAEF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0EAA0E;AAC1E,4BAA4B;AAC5B,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,SAAS,GAAG,IAAI,CAAC;IAErB,SAAS,CAAC;QACR,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACpC,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;QAExB,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAE3C,SAAS,GAAG,MAAM,CAAC;IACrB,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,yCAAyC;AACzC,SAAS,aAAa,CAAC,SAAiB;IACtC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;IAC1D,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjF,CAAC;AAED,SAAS,SAAS,CAAC,MAAe,EAAE,IAAY;IAC9C,MAAM,KAAK,GAAG,MAA6C,CAAC;IAE5D,4EAA4E;IAC5E,sEAAsE;IACtE,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC;IACvD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,wBAAwB,CAAC,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAY;IAC9B,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAErC,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,KAAK,CAAC;QAEpC,sEAAsE;QACtE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE7C,MAAM,UAAU,GAAG,QAAQ,EAAE,CAAC;QAE9B,IAAI,CAAC;YACH,OAAO,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,EAAE,CAAC;QACrB,CAAC;IACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,mEAAmE;AACnE,KAAK,UAAU,OAAO,CAAC,SAAiB;IACtC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC;QAC7D,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CACvB,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CACnD,CAA4C,CAAC;QAE9C,OAAO,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9C,OAAO,MAAM,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,6EAA6E;AAC7E,6EAA6E;AAC7E,SAAS,UAAU,CAAC,IAAY,EAAE,KAAY;IAC5C,MAAM,QAAQ,GAAG;QACf,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,uCAAuC;QACvC,uDAAuD,GAAG,OAAO,CAAC,OAAO;QACzE,6EAA6E;QAC7E,gBAAgB;KACjB,CAAC;IAEF,OAAO,IAAI,KAAK,CACd,kBAAkB,IAAI,OAAO,KAAK,CAAC,OAAO,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EACtE,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;AACJ,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,11 @@
+import type { Deployment } from "../types.js";
+export declare function positional(argv: string[]): string[];
+export declare function main(argv: string[]): Promise<boolean | void>;
+export declare function stopper(on: {
+    abort: () => void;
+    say: (message: string) => void;
+    signal: (name: "TERM" | "KILL") => void;
+    leave: () => void;
+}): () => void;
+export declare function buildingHere(config: Deployment, environment: string): Deployment;
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAc,MAAM,aAAa,CAAC;AA2F1D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,YAgBxC;AAED,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,2BASxC;AAkLD,wBAAgB,OAAO,CAAC,EAAE,EAAE;IAC1B,KAAK,EAAE,MAAM,IAAI,CAAC;IAClB,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAC/B,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;IACxC,KAAK,EAAE,MAAM,IAAI,CAAC;CACnB,cAwBA;AAkCD,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,GAAG,UAAU,CAehF"}