sproutboat 0.4.11 → 0.5.0

package/src/main.ts

@@ -1,13 +1,17 @@
 #!/usr/bin/env bun
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { basename, resolve } from "node:path";
+import { isBoolean, isSafeInteger, isString, jsonObject, parseJsonValue, type JsonObject } from "./json";
+import type { AssetFiles } from "./assets";
 import { parseConfig, pinBindingId, resourceRefs, type SproutboatConfig } from "./config";
 import { validateHttpSyncSource } from "./source";
 import { buildArtifact } from "./build";
-import { validateManifest, type ArtifactManifest } from "./manifest";
+import { bundleHandler, BundleError, type BundleResult } from "./bundle";
+import { runDev } from "./dev";
+import { hostTarget, validateManifest, type ArtifactManifest } from "./manifest";
 import { CLI_VERSION, printDeployReport } from "./report";
-import { activeApiUrl, savedToken, saveToken } from "./credentials";
-import { helpText } from "./surface";
+import { activeApiUrl, forgetToken, savedToken, saveToken } from "./credentials";
+import { helpText, STORAGE_PRODUCTS, STORAGE_VERBS, type StorageProduct } from "./surface";
 import { notifyIfOutdated } from "./update-check";
 import { amber, bold, dim, leaf, ok, rose } from "./style";
 
@@ -18,27 +22,6 @@ async function responseText(response: Response, failure: string): Promise<string
   fail(`${failure} (${response.status}): ${await response.text()}`);
 }
 
-type JsonValue = string | number | boolean | null | JsonObject | JsonValue[];
-type JsonObject = { [key: string]: JsonValue };
-
-function isString(value: JsonValue | undefined): value is string {
-  return value !== undefined && value === String(value);
-}
-
-function isSafeInteger(value: JsonValue | undefined): value is number {
-  return Number.isSafeInteger(value);
-}
-
-function parseJsonValue(source: string): JsonValue {
-  const value = JSON.parse(source);
-  if (value === null || value === true || value === false || value === String(value) || Number.isFinite(value) || value instanceof Object) return value;
-  throw new Error("response was not valid JSON");
-}
-
-function jsonObject(value: JsonValue): JsonObject | undefined {
-  return value instanceof Object && !Array.isArray(value) ? value : undefined;
-}
-
 type VersionSummary = { id: string; artifact: string; deployedAt: string; active: boolean };
 type CliAuthorization = { deviceCode: string; userCode: string; verificationUri: string; interval: number; expiresAt: string };
 
@@ -71,7 +54,7 @@ function parseUrlResponse(source: string): { url: string; id?: string; artifact?
  *  differ between pins. */
 function parsePorfforDrift(source: string): { from: string; to: string } | undefined {
   const drift = (() => { try { return jsonObject(parseJsonValue(source))?.porfforDrift; } catch { return undefined; } })();
-  const record = drift && jsonObject(drift as JsonValue);
+  const record = drift && jsonObject(drift);
   return record && isString(record.from) && isString(record.to) ? { from: record.from, to: record.to } : undefined;
 }
 
@@ -99,6 +82,14 @@ const starterHandler = `export default {
   }
 };
 `;
+// .sproutboat/ holds build output (dist/) and `dev`'s local broker state
+// (dev/, including its SQLite files) — neither belongs in version control.
+// .dev.vars carries secret values for `sproutboat dev`, same convention as
+// Wrangler's file of the same name.
+const starterGitignore = `.sproutboat/
+.dev.vars
+node_modules/
+`;
 
 /** An operational failure — the command was invoked correctly but could not complete. Exit 1. */
 function fail(message: string): never {
@@ -134,21 +125,45 @@ async function readProject(directory = process.cwd()) {
   } catch {
     fail(`entry point not found: ${parsed.value.main}`);
   }
-  const supported = validateHttpSyncSource(source, (parsed.value.outbound ?? []).length > 0);
+  // #89 — resolve imports first, then hold the *bundled* module to the
+  // capability rules. Validating the entry file instead would let a dependency
+  // smuggle in a Node API the handler is not allowed to touch.
+  let bundle: BundleResult;
+  try {
+    bundle = await bundleHandler(sourcePath, projectDirectory);
+  } catch (cause) {
+    fail(cause instanceof BundleError ? cause.message : String(cause));
+  }
+  const supported = validateHttpSyncSource(bundle.code, (parsed.value.outbound ?? []).length > 0);
   if (!supported.ok) fail(supported.errors.join("\n"));
-  return { directory: projectDirectory, config: parsed.value, sourcePath, source };
+  return { directory: projectDirectory, config: parsed.value, sourcePath, source, bundle };
 }
 
 async function init(name = "hello") {
   if (!/^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])?$/.test(name)) fail("project name must be a 3–32 character lowercase slug");
   const directory = resolve(process.cwd(), name);
   const configPath = resolve(directory, "sproutboat.jsonc");
-  if (await Bun.file(configPath).exists()) fail(`${basename(directory)} already contains sproutboat.jsonc`);
+  const handlerPath = resolve(directory, "src/index.js");
+  // Check both targets before writing either — `name` can collide with an
+  // unrelated existing directory, and a second `wx` write failing partway
+  // through used to crash with a raw EEXIST stack trace after already having
+  // created sproutboat.jsonc, leaving a half-scaffolded project behind.
+  for (const [path, label] of [[configPath, "sproutboat.jsonc"], [handlerPath, "src/index.js"]] as const) {
+    if (await Bun.file(path).exists()) fail(`${basename(directory)} already contains ${label}`);
+  }
   await mkdir(resolve(directory, "src"), { recursive: true });
   await writeFile(configPath, starterConfig(name), { flag: "wx" });
-  await writeFile(resolve(directory, "src/index.js"), starterHandler, { flag: "wx" });
+  await writeFile(handlerPath, starterHandler, { flag: "wx" });
   console.log(`Created ${basename(directory)}/sproutboat.jsonc`);
   console.log(`Created ${basename(directory)}/src/index.js`);
+  // Unlike the two files above, an existing .gitignore here is not a sign this
+  // isn't a fresh project (`name` can collide with an unrelated directory) —
+  // leave it alone rather than failing init or clobbering it.
+  const gitignorePath = resolve(directory, ".gitignore");
+  if (!(await Bun.file(gitignorePath).exists())) {
+    await writeFile(gitignorePath, starterGitignore, { flag: "wx" });
+    console.log(`Created ${basename(directory)}/.gitignore`);
+  }
 }
 
 async function check(directory?: string) {
@@ -156,15 +171,40 @@ async function check(directory?: string) {
   console.log(ok(`check passed — ${project.config.name} (${project.config.main}, native-fetch)`));
 }
 
-async function build(directory?: string) {
+async function build(directory?: string, target: "linux-x86_64" | "host" = "linux-x86_64") {
   const project = await readProject(directory);
-  console.log(dim("Compiling the native-fetch server with Porffor + Zig (linux-x86_64, static)…"));
-  const artifact = await buildArtifact({ projectDir: project.directory, config: project.config, sourcePath: project.sourcePath });
+  console.log(target === "host"
+    ? dim(`Compiling the native-fetch server with Porffor for this machine (${hostTarget()}, local only)…`)
+    : dim("Compiling the native-fetch server with Porffor + Zig (linux-x86_64, static)…"));
+  const artifact = await buildArtifact({ projectDir: project.directory, config: project.config, sourcePath: project.sourcePath, source: project.bundle.code, target });
   console.log(ok(`built ${project.config.name}`));
+  if (target === "host") console.log(dim("  host build — runs here, not deployable; drop --target host to build for a box"));
   console.log(artifact.artifactDir);
   return { project, artifact };
 }
 
+/** #62 — build for this machine, run it against a real broker, rebuild on save. */
+async function dev(args: string[]) {
+  const directory = args.find((arg) => !arg.startsWith("--") && !/^\d+$/.test(arg));
+  const portIndex = args.indexOf("--port");
+  const portArg = portIndex >= 0 ? args[portIndex + 1] : undefined;
+  const port = Number(portArg ?? 8787);
+  if (!Number.isSafeInteger(port) || port < 1 || port > 65_535) usageError(`invalid --port: ${portArg}`, "dev [project-dir] [--port <n>] [--no-watch]");
+  const project = await readProject(directory);
+  console.log(dim(`Building ${project.config.name} for this machine (${hostTarget()})…`));
+  await runDev({
+    projectDir: project.directory,
+    config: project.config,
+    sourcePath: project.sourcePath,
+    source: project.bundle.code,
+    port,
+    watch: !args.includes("--no-watch"),
+    // Re-read from disk on every rebuild: the point of watching is that the
+    // files changed, so the bundle captured at startup is stale by definition.
+    rebuild: async () => (await readProject(directory)).bundle.code,
+  });
+}
+
 const PROVISION_FIELDS = [
   ["kv_namespaces", "kv"],
   ["d1_databases", "d1"],
@@ -211,6 +251,38 @@ async function provisionBindings(directory = process.cwd()): Promise<void> {
   await writeFile(configPath, source);
 }
 
+/** #79 — wrangler parity: drop the stored credential for an endpoint. */
+async function logout(args: string[]) {
+  const { apiUrl } = parseLoginArgs(args);
+  console.log(await forgetToken(apiUrl)
+    ? ok(`forgot the credential for ${apiUrl}`)
+    : `no stored credential for ${apiUrl}`);
+}
+
+/**
+ * #79 — wrangler parity: which endpoint, and who the stored token belongs to.
+ * The account comes from the control plane, so this also proves the token still
+ * works rather than only reporting what is on disk.
+ */
+async function whoami() {
+  const apiUrl = process.env.SPROUTBOAT_API_URL || await activeApiUrl();
+  if (!apiUrl) { console.log("not logged in — run `sproutboat login`"); return; }
+  const token = process.env.SPROUTBOAT_TOKEN || await savedToken(apiUrl);
+  console.log(`endpoint  ${apiUrl}`);
+  if (!token) { console.log(`account   ${dim("no stored token — run `sproutboat login`")}`); return; }
+
+  const response = await fetch(`${apiUrl}/api/account`, { headers: { "x-api-key": token } });
+  if (!response.ok) {
+    console.log(`account   ${rose(response.status === 401 ? "token rejected — run `sproutboat login`" : `control plane said ${response.status}`)}`);
+    return;
+  }
+  const account = jsonObject(parseJsonValue(await response.text()));
+  const profile = jsonObject(account?.profile ?? null);
+  const user = jsonObject(account?.user ?? null);
+  console.log(`account   ${isString(profile?.username) ? profile.username : "(no namespace reserved)"}`);
+  if (user && isString(user.email)) console.log(`email     ${user.email}`);
+}
+
 async function deploy(args: string[]) {
   const artifactIndex = args.indexOf("--artifact");
   const dryRun = args.includes("--dry-run");
@@ -264,7 +336,8 @@ async function deploy(args: string[]) {
   }
   const assetsManifestFile = Bun.file(resolve(artifactDir, "assets.json"));
   if (await assetsManifestFile.exists()) {
-    const assetsManifest: { files?: Record<string, unknown> } = await assetsManifestFile.json();
+    // assets.json is written by `sproutboat build` from the AssetManifest contract.
+    const assetsManifest: { files?: AssetFiles } = await assetsManifestFile.json();
     form.set("assets_manifest", new File([await assetsManifestFile.arrayBuffer()], "assets.json", { type: "application/json" }));
     for (const key of Object.keys(assetsManifest.files ?? {})) {
       const file = Bun.file(resolve(artifactDir, "assets", `.${key}`));
@@ -381,8 +454,40 @@ async function apiCredentials() {
 }
 
 async function versions(args: string[]) {
-  if (args[0] !== "list") usageError(args[0] ? `versions: unknown subcommand "${args[0]}"` : "versions: missing subcommand", "versions list [project-dir]");
-  const [project, { apiUrl, token }] = await Promise.all([readProject(args[1]), apiCredentials()]);
+  const sub = args[0];
+  if (sub !== "list" && sub !== "view") {
+    usageError(sub ? `versions: unknown subcommand "${sub}"` : "versions: missing subcommand", "versions <list | view <version-id>> [project-dir]");
+  }
+  args.shift();
+
+  if (sub === "view") {
+    const id = args.shift();
+    if (!id) usageError("versions view: missing <version-id>", "versions view <version-id> [project-dir]");
+    const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+    const body = await responseText(
+      await fetch(`${apiUrl}/api/projects/${project.config.name}/deployments/${encodeURIComponent(id)}`, { headers: { "x-api-key": token } }),
+      "could not read that version",
+    );
+    const detail = jsonObject(parseJsonValue(body));
+    if (!detail) fail("could not parse version response");
+    const manifest = jsonObject(detail.manifest ?? null);
+    console.log(`${bold(String(detail.id))} ${detail.active ? ok("active") : dim("superseded")}`);
+    console.log(`  route     ${String(detail.hostname)}`);
+    console.log(`  artifact  ${String(detail.artifact)}`);
+    console.log(`  deployed  ${String(detail.deployedAt)}${isString(detail.deployedBy) ? ` by ${detail.deployedBy}` : ""}`);
+    if (manifest) {
+      console.log(`  built     ${String(manifest.builtAt)} · porffor ${String(manifest.porfforVersion)} · ${String(manifest.binarySize)} bytes`);
+    } else if (isString(detail.manifestError)) {
+      console.log(`  ! manifest unavailable: ${detail.manifestError}`);
+    }
+    const resources = Array.isArray(detail.resources) ? detail.resources.map((entry) => jsonObject(entry)) : [];
+    for (const resource of resources) {
+      if (resource) console.log(`  bound     ${String(resource.kind)} ${String(resource.name)} ${dim(String(resource.id))}`);
+    }
+    return;
+  }
+
+  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
   const response = await fetch(`${apiUrl}/api/projects/${project.config.name}/deployments`, { headers: { "x-api-key": token } });
   const deployments = parseVersionList(await responseText(response, "could not list versions"));
   if (!deployments) fail("could not parse versions response");
@@ -418,7 +523,7 @@ type DomainView = {
 };
 function parseDomain(source: string): DomainView | undefined {
   const record = jsonObject(parseJsonValue(source));
-  if (!record || !isString(record.hostname) || typeof record.verified !== "boolean") return undefined;
+  if (!record || !isString(record.hostname) || !isBoolean(record.verified)) return undefined;
   const v = jsonObject(record.verification ?? null);
   const verification = v && isString(v.type) && isString(v.name) && isString(v.value) ? { type: v.type, name: v.name, value: v.value } : null;
   const serverAddresses = Array.isArray(record.serverAddresses) ? record.serverAddresses.filter(isString) : [];
@@ -438,7 +543,7 @@ function printDomain(domain: DomainView) {
 }
 
 async function domains(args: string[]) {
-  const sub = args[0] && !args[0].startsWith("-") && ["list", "add", "verify", "rm"].includes(args[0]) ? args.shift()! : "list";
+  const sub = args[0] && !args[0].startsWith("-") && ["list", "add", "verify", "delete"].includes(args[0]) ? args.shift()! : "list";
   const host = sub === "list" ? undefined : args.shift();
   if (sub !== "list" && !host) usageError(`domains ${sub}: missing <hostname>`, `domains ${sub} <hostname> [project-dir]`);
   const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
@@ -454,7 +559,7 @@ async function domains(args: string[]) {
     for (const entry of list) { const d = parseDomain(JSON.stringify(entry)); if (d) printDomain(d); }
     return;
   }
-  if (sub === "rm") {
+  if (sub === "delete") {
     const response = await fetch(`${base}/${host}`, { method: "DELETE", headers: auth });
     await responseText(response, "delete rejected");
     console.log(ok(`removed ${host}`));
@@ -471,11 +576,23 @@ async function domains(args: string[]) {
 }
 
 async function secrets(args: string[]) {
-  const sub = args[0] && ["list", "set", "rm"].includes(args[0]) ? args.shift()! : "list";
-  const name = sub === "list" ? undefined : args.shift();
+  const sub = args[0] && ["list", "put", "delete"].includes(args[0]) ? args.shift()! : "list";
+
+  // `--value` is opt-in; without it the value comes from stdin, so a secret does
+  // not land in shell history. It is also what disambiguates the positionals:
+  // `secrets put NAME <value> [project-dir]` could not tell a value from a path,
+  // and read the value as the project directory.
+  let inlineValue: string | undefined;
+  const positional: string[] = [];
+  for (let index = 0; index < args.length; index += 1) {
+    if (args[index] === "--value") inlineValue = args[(index += 1)];
+    else positional.push(args[index]);
+  }
+
+  const name = sub === "list" ? undefined : positional.shift();
   if (sub !== "list" && !name) usageError(`secrets ${sub}: missing <NAME>`, `secrets ${sub} <NAME> [project-dir]`);
   if (name && !/^[A-Z][A-Z0-9_]*$/.test(name)) fail("secret name must be UPPER_SNAKE_CASE");
-  const [project, { apiUrl, token }] = await Promise.all([readProject(args[0]), apiCredentials()]);
+  const [project, { apiUrl, token }] = await Promise.all([readProject(positional[0]), apiCredentials()]);
   const base = `${apiUrl}/api/projects/${project.config.name}/secrets`;
   const auth = { "x-api-key": token };
 
@@ -486,78 +603,104 @@ async function secrets(args: string[]) {
     console.log(names.length ? names.join("\n") : "no secrets");
     return;
   }
-  if (sub === "rm") {
+  if (sub === "delete") {
     await responseText(await fetch(`${base}/${name}`, { method: "DELETE", headers: auth }), "delete rejected");
     console.log(ok(`removed ${name}`));
     return;
   }
-  // set: value from the next arg, else stdin (keeps it out of shell history).
-  const value = args[1] && !args[1].startsWith("-") && args[1] !== project.directory
-    ? args[1]
-    : (await Bun.stdin.text()).replace(/\r?\n$/, "");
-  if (!value) fail("no value — pass it as an argument or pipe it on stdin");
+
+  const value = inlineValue ?? (await Bun.stdin.text()).replace(/\r?\n$/, "");
+  if (!value) fail("no value — pipe it on stdin, or pass --value <value>");
   await responseText(
     await fetch(`${base}/${name}`, { method: "PUT", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ value }) }),
-    "set rejected",
+    "put rejected",
   );
-  console.log(`Set ${name} — applies on the next deploy or sprout restart`);
+  console.log(ok(`set ${name} — applies on the next deploy or sprout restart`));
 }
 
-const RESOURCE_KINDS = ["kv", "d1", "r2", "queue"];
-
 /**
- * #74 — account-level storage resources. Unlike `secrets`/`domains` these are
- * not project-scoped, so there's no `readProject` here. `create` prints the
- * `<kind>_<id>` handle to paste into `sproutboat.jsonc` bindings.
+ * #79 — one command per storage product (`kv`, `d1`, `r2`, `queues`), each with
+ * the same five verbs, over that product's own `/api/<product>` collection.
+ *
+ * Wrangler nests two of its four (`kv namespace create`, `r2 bucket create`)
+ * and leaves `d1 create` and `queues create` flat. The nesting is there to
+ * separate the container from its contents, which the verb already does — so
+ * ours are uniform, and contents take their own noun when they exist
+ * (`kv key get`, `r2 object put`).
  */
-async function resource(args: string[]) {
-  const sub = args[0] && ["list", "create", "rename", "delete"].includes(args[0]) ? args.shift()! : "list";
+/** The account's resources of one kind, by name. */
+async function storageRows(base: string, auth: Record<string, string>, product: StorageProduct): Promise<JsonObject[]> {
+  const body = await responseText(await fetch(base, { headers: auth }), `could not list ${product.plural}`);
+  const parsed = jsonObject(parseJsonValue(body));
+  return (parsed && Array.isArray(parsed.resources) ? parsed.resources : [])
+    .map((entry) => jsonObject(entry))
+    .filter((entry): entry is JsonObject => Boolean(entry));
+}
+
+/** Resolve a name to its `<kind>_<id>` handle — the API addresses rows by id. */
+function idForName(rows: JsonObject[], name: string, product: StorageProduct): string {
+  const match = rows.find((row) => row.name === name);
+  if (!match || !isString(match.id)) fail(`no ${product.noun} named "${name}"`);
+  return String(match.id);
+}
+
+async function storage(key: string, args: string[]) {
+  const product = STORAGE_PRODUCTS.find((entry) => entry.name === key)!;
+  const sub = args[0] && STORAGE_VERBS.some((verb) => verb === args[0]) ? args.shift()! : "list";
   const { apiUrl, token } = await apiCredentials();
-  const base = `${apiUrl}/api/resources`;
+  const base = `${apiUrl}/api/${product.name}`;
   const auth = { "x-api-key": token };
 
   if (sub === "list") {
-    const kindFilter = args[0];
-    const body = await responseText(await fetch(base, { headers: auth }), "could not list resources");
-    const parsed = jsonObject(parseJsonValue(body));
-    const rows = (parsed && Array.isArray(parsed.resources) ? parsed.resources : [])
-      .map((entry) => jsonObject(entry))
-      .filter((entry): entry is JsonObject => Boolean(entry) && (!kindFilter || entry!.kind === kindFilter));
-    if (rows.length === 0) { console.log(kindFilter ? `no ${kindFilter} resources` : "no resources"); return; }
-    for (const row of rows) console.log(`${String(row.kind).padEnd(9)} ${String(row.id).padEnd(30)} ${String(row.name)}`);
+    const rows = await storageRows(base, auth, product);
+    if (rows.length === 0) { console.log(`no ${product.plural}`); return; }
+    for (const row of rows) {
+      const bound = Array.isArray(row.projects) ? row.projects.filter(isString) : [];
+      console.log(`${String(row.id).padEnd(30)} ${String(row.name).padEnd(24)} ${bound.length ? bound.join(", ") : dim("unbound")}`);
+    }
     return;
   }
 
+  const name = args.shift();
+  if (!name) usageError(`${key} ${sub}: missing <name>`, `${key} ${sub} <name>`);
+
   if (sub === "create") {
-    const [kind, name] = args;
-    if (!kind || !RESOURCE_KINDS.includes(kind)) usageError(`resource create: kind must be one of ${RESOURCE_KINDS.join(", ")}`, "resource create <kind> <name>");
-    if (!name) usageError("resource create: missing <name>", "resource create <kind> <name>");
     const body = await responseText(
-      await fetch(base, { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ kind, name }) }),
+      await fetch(base, { method: "POST", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ name }) }),
       "create rejected",
     );
     const record = jsonObject(jsonObject(parseJsonValue(body))?.resource ?? null);
     if (!record || !isString(record.id)) fail("create response was not a resource");
-    console.log(ok(`created ${kind} ${bold(String(record.name))}`));
+    console.log(ok(`created ${product.noun} ${bold(String(record.name))}`));
     console.log(record.id);
     return;
   }
 
+  const rows = await storageRows(base, auth, product);
+  const id = idForName(rows, name, product);
+
+  if (sub === "info") {
+    const row = rows.find((entry) => entry.id === id)!;
+    const bound = Array.isArray(row.projects) ? row.projects.filter(isString) : [];
+    console.log(`${bold(String(row.name))}  ${dim(String(row.id))}`);
+    console.log(`  created  ${String(row.createdAt)}`);
+    console.log(`  bound to ${bound.length ? bound.join(", ") : "nothing"}`);
+    return;
+  }
+
   if (sub === "rename") {
-    const [id, name] = args;
-    if (!id || !name) usageError("resource rename: need <id> <name>", "resource rename <id> <name>");
+    const next = args.shift();
+    if (!next) usageError(`${key} rename: missing <new-name>`, `${key} rename <name> <new-name>`);
     await responseText(
-      await fetch(`${base}/${id}`, { method: "PATCH", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ name }) }),
+      await fetch(`${base}/${id}`, { method: "PATCH", headers: { ...auth, "content-type": "application/json" }, body: JSON.stringify({ name: next }) }),
       "rename rejected",
     );
-    console.log(ok(`renamed ${id} → ${name}`));
+    console.log(ok(`renamed ${name} → ${next}`));
     return;
   }
 
-  const id = args[0];
-  if (!id) usageError("resource delete: missing <id>", "resource delete <id>");
   await responseText(await fetch(`${base}/${id}`, { method: "DELETE", headers: auth }), "delete rejected");
-  console.log(ok(`deleted ${id}`));
+  console.log(ok(`deleted ${product.noun} ${name}`));
 }
 
 async function deleteProject(args: string[]) {
@@ -612,14 +755,21 @@ await notifyIfOutdated(CLI_VERSION);
 switch (command) {
   case "init": await init(args[0]); break;
   case "check": await check(args[0]); break;
-  case "build": await build(args[0]); break;
+  case "dev": await dev(args); break;
+  case "build": {
+    const hostBuild = args.includes("--target") && args[args.indexOf("--target") + 1] === "host";
+    await build(args.find((arg) => !arg.startsWith("--") && arg !== "host"), hostBuild ? "host" : "linux-x86_64");
+    break;
+  }
   case "login": await login(args); break;
+  case "logout": await logout(args); break;
+  case "whoami": await whoami(); break;
   case "deploy": await deploy(args); break;
   case "versions": await versions(args); break;
   case "rollback": await rollback(args); break;
   case "domains": await domains(args); break;
   case "secrets": await secrets(args); break;
-  case "resource": await resource(args); break;
+  case "kv": case "d1": case "r2": case "queues": await storage(command, args); break;
   case "tail": await tail(args); break;
   case "delete": await deleteProject(args); break;
   default: usage();

package/src/manifest.ts

@@ -2,10 +2,22 @@ export const ARTIFACT_SCHEMA_VERSION = 2;
 export const RUNTIME = "native-fetch";
 export const CAPABILITY_PROFILE = "http-sync-v0";
 
+/** The only target a deployed artifact may carry. Every box runs linux-x86_64. */
+export const DEPLOY_TARGET = "linux-x86_64";
+
+/**
+ * `<arch>-<platform>` of the machine doing the build, e.g. `arm64-darwin`.
+ * Only `sproutboat build --target host` produces one (#62): it runs on this
+ * machine for local dev and is deliberately not portable, so `validateManifest`
+ * rejects it and neither `deploy` nor the control plane will accept it.
+ */
+export type HostTarget = `${string}-${string}`;
+export const hostTarget = (): HostTarget => `${process.arch}-${process.platform}`;
+
 export type ArtifactManifest = {
   schemaVersion: 2;
   project: string;
-  target: "linux-x86_64";
+  target: typeof DEPLOY_TARGET | HostTarget;
   runtime: "native-fetch";
   capabilityProfile: "http-sync-v0";
   porfforVersion: string;
@@ -56,8 +68,14 @@ export function validateManifest(value: ManifestInput): ManifestValidation {
   if (schemaVersion === null) errors.push("schemaVersion must be 2");
   const project = isString(value.project) && /^[a-z0-9](?:[a-z0-9-]{1,30}[a-z0-9])?$/.test(value.project) ? value.project : null;
   if (project === null) errors.push("project must be a valid slug");
-  const target = value.target === "linux-x86_64" ? value.target : null;
-  if (target === null) errors.push("target must be linux-x86_64");
+  const target = value.target === DEPLOY_TARGET ? value.target : null;
+  if (target === null) {
+    // A `--target host` artifact lands here: runnable where it was built, not
+    // on a box. Name that, so the failure reads as "wrong build" not "corrupt".
+    errors.push(isString(value.target) && value.target !== DEPLOY_TARGET
+      ? `target must be ${DEPLOY_TARGET}, got ${value.target} — \`--target host\` builds are for local dev and cannot be deployed`
+      : `target must be ${DEPLOY_TARGET}`);
+  }
   const runtime = value.runtime === RUNTIME ? value.runtime : null;
   if (runtime === null) errors.push("runtime must be native-fetch");
   const capabilityProfile = value.capabilityProfile === CAPABILITY_PROFILE ? value.capabilityProfile : null;