devlift-cli 0.1.0__py3-none-any.whl

devlift_cli/config.py

@@ -0,0 +1,94 @@
+"""Profiles and settings.
+
+~/.config/devlift/cli.json:
+
+    {
+      "default_profile": "default",
+      "profiles": {
+        "default": {"base_url": "http://localhost:8000", "output": "table"},
+        "stage":   {"base_url": "https://devlift.example.com"}
+      }
+    }
+
+Environment overrides (highest precedence): DEVLIFT_PROFILE, DEVLIFT_BASE_URL,
+DEVLIFT_TOKEN (skips the stored credentials entirely), DEVLIFT_OUTPUT.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+from dataclasses import dataclass
+from pathlib import Path
+
+DEFAULT_BASE_URL = "http://localhost:8000"
+API_PREFIX = "/api/v1"
+OAUTH_METADATA_PATH = "/.well-known/oauth-authorization-server/devlift-mcp"
+
+CONFIG_DIR = Path(os.environ.get("DEVLIFT_CONFIG_DIR", Path.home() / ".config" / "devlift"))
+CONFIG_FILE = CONFIG_DIR / "cli.json"
+PROJECT_FILE_NAME = "project.json"
+
+
+@dataclass
+class Profile:
+    name: str
+    base_url: str = DEFAULT_BASE_URL
+    output: str = "table"
+
+    @property
+    def api_url(self) -> str:
+        return self.base_url.rstrip("/") + API_PREFIX
+
+
+def _read_file() -> dict:
+    try:
+        return json.loads(CONFIG_FILE.read_text())
+    except (FileNotFoundError, ValueError):
+        return {}
+
+
+def _write_file(data: dict) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    tmp = CONFIG_FILE.with_suffix(".tmp")
+    tmp.write_text(json.dumps(data, indent=2) + "\n")
+    tmp.chmod(0o600)
+    tmp.replace(CONFIG_FILE)
+
+
+def list_profiles() -> dict[str, dict]:
+    return dict(_read_file().get("profiles") or {})
+
+
+def default_profile_name() -> str:
+    return os.environ.get("DEVLIFT_PROFILE") or _read_file().get("default_profile") or "default"
+
+
+def load_profile(name: str | None = None, base_url_override: str | None = None) -> Profile:
+    name = name or default_profile_name()
+    raw = list_profiles().get(name) or {}
+    base_url = base_url_override or os.environ.get("DEVLIFT_BASE_URL") or raw.get("base_url") or DEFAULT_BASE_URL
+    output = os.environ.get("DEVLIFT_OUTPUT") or raw.get("output") or "table"
+    return Profile(name=name, base_url=base_url.rstrip("/"), output=output)
+
+
+def save_profile(profile: Profile, make_default: bool = False) -> None:
+    data = _read_file()
+    profiles = data.setdefault("profiles", {})
+    profiles[profile.name] = {"base_url": profile.base_url, "output": profile.output}
+    if make_default or "default_profile" not in data:
+        data["default_profile"] = profile.name
+    _write_file(data)
+
+
+def find_project_id(start: Path | None = None) -> str | None:
+    """`.devlift/project.json` in the cwd or any parent, like `.git`."""
+    here = (start or Path.cwd()).resolve()
+    for directory in (here, *here.parents):
+        candidate = directory / ".devlift" / PROJECT_FILE_NAME
+        if candidate.is_file():
+            try:
+                return json.loads(candidate.read_text()).get("project_id")
+            except ValueError:
+                return None
+    return None

devlift_cli/context.py

@@ -0,0 +1,97 @@
+"""Per-invocation state shared by every command: profile, output format,
+confirmation policy, and a lazily built API client."""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+from devlift_cli.api.client import ApiClient
+from devlift_cli.auth.session import TokenSource
+from devlift_cli.config import Profile
+from devlift_cli.errors import ConfirmationRequired, InputError
+from devlift_cli.render import output
+
+
+@dataclass
+class Invocation:
+    profile: Profile
+    output: str
+    yes: bool = False
+    no_input: bool = False
+    debug: bool = False
+    _api: ApiClient | None = field(default=None, repr=False)
+
+    @property
+    def api(self) -> ApiClient:
+        if self._api is None:
+            self._api = ApiClient(self.profile, TokenSource(self.profile), debug=self.debug)
+        return self._api
+
+    @property
+    def interactive(self) -> bool:
+        import sys
+
+        return not self.no_input and sys.stdin.isatty()
+
+    @property
+    def show_summary(self) -> bool:
+        """Print the pre-confirmation summary (tables on stderr)?
+
+        On a terminal or in table mode, always. In json mode it is also
+        printed whenever the run is a DRY RUN (no --yes): a script or an agent
+        that runs a write without -y is asking "what would this do?", and the
+        answer has to be visible, not only the exit-5 line. Only a scripted
+        `-y -o json` run stays quiet."""
+        return self.output == "table" or self.interactive or not self.yes
+
+    def confirm(self, question: str) -> None:
+        """Proceed, or raise. --yes answers; --no-input without --yes refuses."""
+        if self.yes:
+            return
+        if not self.interactive:
+            raise ConfirmationRequired(f"{question} (needs confirmation)")
+        from rich.prompt import Confirm
+
+        if not Confirm.ask(question, default=False, console=output.err_console):
+            raise ConfirmationRequired("Cancelled.")
+
+    def ask(self, label: str, *, choices: list[str] | None = None, default: str | None = None, flag: str | None = None) -> str:
+        """Prompt for a missing value, or refuse under --no-input naming the flag."""
+        if not self.interactive:
+            raise InputError(f"{label} is required.", hint=f"Pass {flag}." if flag else None)
+        from rich.prompt import Prompt
+
+        if choices and len(choices) <= 12:
+            output.err_console.print(f"[bold]{label}[/bold]")
+            for i, choice in enumerate(choices, 1):
+                output.err_console.print(f"  {i}. {choice}")
+            while True:
+                raw = Prompt.ask("Choose (number or name)", default=default, console=output.err_console)
+                if raw is None:
+                    continue
+                raw = raw.strip()
+                if raw.isdigit() and 1 <= int(raw) <= len(choices):
+                    return choices[int(raw) - 1]
+                match = [c for c in choices if c.lower() == raw.lower()]
+                if match:
+                    return match[0]
+                output.warn(f"Pick one of 1-{len(choices)}.")
+        while True:
+            raw = Prompt.ask(label, default=default, console=output.err_console)
+            if raw and raw.strip():
+                return raw.strip()
+            output.warn(f"{label} is required.")
+
+    def ask_bool(self, question: str, *, default: bool = False, flag: str | None = None) -> bool:
+        if not self.interactive:
+            raise InputError(f"{question} needs an answer.", hint=f"Pass {flag}." if flag else None)
+        from rich.prompt import Confirm
+
+        return Confirm.ask(question, default=default, console=output.err_console)
+
+    def emit(self, data, table=None) -> None:
+        output.emit(data, self.output, table)
+
+    def close(self) -> None:
+        if self._api is not None:
+            self._api.close()

devlift_cli/data/placement/vance.json

@@ -0,0 +1,16 @@
+{
+ "_tenants": ["vance", "aspora"],
+
+ "Default_workspace": {
+  "core": {
+    "stage": {
+      "ap-south-1": ["database", "dynamo", "gateway", "s3", "sqs", "eks"]
+    },
+
+    "prod": {
+      "ap-south-1": ["database", "gateway", "s3", "sqs"],
+      "eu-west-2": ["database", "dynamo", "gateway", "s3", "sqs", "eks"]
+    }
+  }
+ }
+}

devlift_cli/errors.py

@@ -0,0 +1,52 @@
+"""One error type, one exit-code table.
+
+Every command failure is raised as a CliError and printed once, in main().
+The codes are part of the CLI's contract for scripts:
+
+    0  ok
+    1  error (server 5xx, unexpected)
+    2  not authenticated — run `devlift login`
+    3  missing / invalid input, ambiguous name
+    4  permission refused (403)
+    5  confirmation required (no --yes under --no-input)
+    6  not found (404)
+    7  conflict / lane busy / wrong state (409)
+"""
+
+EXIT_OK = 0
+EXIT_ERROR = 1
+EXIT_AUTH = 2
+EXIT_INPUT = 3
+EXIT_PERMISSION = 4
+EXIT_CONFIRM = 5
+EXIT_NOT_FOUND = 6
+EXIT_CONFLICT = 7
+
+
+class CliError(Exception):
+    def __init__(self, message: str, code: int = EXIT_ERROR, hint: str | None = None, http_status: int | None = None):
+        super().__init__(message)
+        self.message = message
+        self.code = code
+        self.hint = hint
+        self.http_status = http_status
+
+    @property
+    def transient(self) -> bool:
+        """A server-side hiccup worth retrying (bad gateway, unavailable, timeout)."""
+        return self.http_status in (502, 503, 504)
+
+
+class AuthError(CliError):
+    def __init__(self, message: str = "Not signed in.", hint: str | None = "Run `devlift login`."):
+        super().__init__(message, EXIT_AUTH, hint)
+
+
+class InputError(CliError):
+    def __init__(self, message: str, hint: str | None = None):
+        super().__init__(message, EXIT_INPUT, hint)
+
+
+class ConfirmationRequired(CliError):
+    def __init__(self, message: str = "Confirmation required."):
+        super().__init__(message, EXIT_CONFIRM, "Pass --yes to confirm non-interactively.")

devlift_cli/ops/approvals.py

@@ -0,0 +1,343 @@
+"""`devlift request …`, `devlift approval …`, `devlift eks deploy`: the review lane.
+
+A service's change is a CHANGE SET: its settings row, its gateway-routes row
+and its variables row in the transaction queue, all for one service
+configuration and one author. The backend moves the whole set on every verb
+(submit, approve, ...), so here a request is named either by its queue code
+or by the service, and the output lists every row that moved.
+
+    draft ──submit──▶ submit ──approve──▶ approved ──deploy──▶ in flight
+      ▲                 │ ▲                   │
+      └───withdraw──────┘ └─────revoke────────┘
+      └──request-changes──┘        reject ──▶ rejected (terminal)
+    discard: a draft is thrown away
+
+Deploy is `POST /deployments/multiple-deploy {service_config_code}`: obs_tool
+resolves the approved rows itself, runs the gate (status, can_deploy, seal)
+and starts one Temporal batch — the same single call the dashboard makes.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+
+from devlift_cli.api import approvals as approvals_api
+from devlift_cli.api import kong as kong_api
+from devlift_cli.context import Invocation
+from devlift_cli.errors import EXIT_CONFLICT, EXIT_INPUT, EXIT_NOT_FOUND, CliError, InputError
+from devlift_cli.ops import wait
+from devlift_cli.render import output
+from devlift_cli.render.output import kv_table, rows_table
+from devlift_cli.resolve.names import Resolver
+
+KIND = {"update_service": "Settings", "add_route": "Gateway routes", "update_variables": "Variables", "delete_service": "Delete service"}
+
+# Which statuses each verb starts from, and whether only the author may call it.
+VERB_FROM = {
+    "submit": ("draft",), "discard": ("draft",), "withdraw": ("submit",),
+    "approve": ("submit",), "request-changes": ("submit",), "reject": ("submit",), "revoke": ("approved",),
+}
+AUTHOR_VERBS = ("submit", "discard", "withdraw")
+VERB_DONE = {
+    "submit": "submitted for review", "discard": "discarded", "withdraw": "withdrawn, back with you as a draft",
+    "approve": "approved — it can be deployed", "request-changes": "sent back to the author as a draft",
+    "reject": "rejected", "revoke": "approval taken back — waiting for a decision again",
+}
+
+
+def kind_of(row: dict) -> str:
+    return KIND.get(row.get("case_ref_code") or "", row.get("case_ref_code") or row.get("resource_type") or "?")
+
+
+# ── finding the request ──────────────────────────────────────────────────────
+
+@dataclass
+class Target:
+    config_code: str
+    service_name: str
+    environment: str | None
+    region_name: str | None
+
+
+def _target_from_row(inv: Invocation, row: dict) -> Target:
+    """A queue row names its configuration; the environment is read from the
+    service's configurations, since the row itself does not carry it."""
+    code = row.get("resource_code") or ""
+    name = (row.get("config_snapshot") or {}).get("service_name") or row.get("display_name") or code
+    env = region = None
+    services_mst_code = (row.get("config_snapshot") or {}).get("services_mst_code")
+    if services_mst_code:
+        for o in kong_api.env_geo_options(inv.api, services_mst_code):
+            if o.get("config_code") == code:
+                env, region = o.get("environment"), o.get("geo_loc_name") or o.get("geo_loc_code")
+                name = name if name != code else o.get("service_name") or name
+    return Target(code, name, env, region)
+
+
+def resolve_target(inv: Invocation, res: Resolver, service: str, env: str | None, region: str | None) -> Target:
+    from devlift_cli.ops.kong import resolve_target as _rt   # same lookup the kong commands use
+    t = _rt(inv, res, service, env, region)
+    return Target(t.config_code, t.service_name, t.environment, t.region_name)
+
+
+def find_requests(inv: Invocation, res: Resolver, ref: str, *, env: str | None, region: str | None,
+                  statuses: tuple[str, ...] | None, mine_only: bool) -> tuple[Target, list[dict]]:
+    """The change set the user means: by queue code (that row's set) or by
+    service (every row on its configuration in the wanted statuses)."""
+    if ref.startswith("queue-"):
+        row = approvals_api.get_request(inv.api, ref)
+        target = _target_from_row(inv, row)
+        rows = approvals_api.list_requests(inv.api, resource_code=target.config_code)
+        same = [r for r in rows if r.get("status") == row.get("status") and r.get("requested_by") == row.get("requested_by")]
+        if all(r["code"] != row["code"] for r in same):
+            same.append(row)
+        return target, sorted(same, key=lambda r: r["code"] != row["code"])
+    target = resolve_target(inv, res, ref, env, region)
+    rows = approvals_api.list_requests(inv.api, resource_code=target.config_code)
+    if statuses:
+        rows = [r for r in rows if r.get("status") in statuses]
+    if mine_only:
+        rows = [r for r in rows if (r.get("you") or {}).get("mine")]
+    authors = {r.get("requested_by") for r in rows}
+    if len(authors) > 1:
+        raise CliError(
+            f"{target.service_name} has requests from several people: " + ", ".join(
+                f"{r['code']} ({r.get('requested_by_name') or r.get('requested_by')}, {r['status']})" for r in rows),
+            EXIT_INPUT, hint="Name the queue code instead of the service.",
+        )
+    return target, rows
+
+
+# ── showing it ───────────────────────────────────────────────────────────────
+
+def diff_rows(row: dict) -> list[tuple[str, str, str]]:
+    """The frozen diff as (field, from, to). Settings rows carry a field map;
+    a gateway row carries the groups with their path actions."""
+    changes = row.get("changes") or {}
+    out: list[tuple[str, str, str]] = []
+    if "groups" in changes:
+        for g in changes.get("groups") or []:
+            label = f"{g.get('route_group_key')} · {g.get('http_method')}"
+            for p in g.get("paths") or []:
+                act = (p.get("action") or "").lower()
+                if act == "add":
+                    out.append((label, "–", p.get("route_path") or ""))
+                elif act == "delete":
+                    out.append((label, p.get("route_path") or "", "– (removed)"))
+                elif act == "edit":
+                    out.append((label, p.get("old_path") or "", p.get("route_path") or ""))
+            pb, pa = g.get("plugins_before") or [], g.get("plugins_after") or []
+            if sorted(pb) != sorted(pa):
+                out.append((f"{label} plugins", ", ".join(pb) or "–", ", ".join(pa) or "–"))
+            rb, ra = g.get("regex_priority_before") or 0, g.get("regex_priority_after") or 0
+            if rb != ra:
+                out.append((f"{label} priority", str(rb), str(ra)))
+        return out
+    for field, move in changes.items():
+        if isinstance(move, dict) and ("from" in move or "to" in move):
+            out.append((field, _v(move.get("from")), _v(move.get("to"))))
+        else:
+            out.append((field, "", _v(move)))
+    return out
+
+
+def _v(value) -> str:
+    if value is None or value == "":
+        return "–"
+    if isinstance(value, list):
+        return ", ".join(str(x) for x in value)
+    return str(value)
+
+
+def print_request(row: dict, *, with_diff: bool = True) -> None:
+    you = row.get("you") or {}
+    rows = [
+        ("Request", f"{row.get('code')}  ({kind_of(row)})"),
+        ("Service", row.get("display_name")),
+        ("Status", row.get("status")),
+        ("Requested by", f"{row.get('requested_by_name') or row.get('requested_by')}" + ("  (you)" if you.get("mine") else "")),
+        ("Requested at", (row.get("requested_at") or "")[:19].replace("T", " ")),
+    ]
+    if row.get("decided_by"):
+        rows.append(("Decided by", f"{row.get('decided_by_name') or row.get('decided_by')} at {(row.get('decided_at') or '')[:19].replace('T', ' ')}"))
+    if row.get("decision_comment"):
+        rows.append(("Comment", row["decision_comment"]))
+    rows.append(("You may", ", ".join(k[4:].replace("_", " ") for k in ("can_approve", "can_deploy") if you.get(k)) or "–"))
+    output.err_console.print(kv_table(rows))
+    if with_diff:
+        diff = diff_rows(row)
+        if diff:
+            output.err_console.print(rows_table(["Field", "From", "To"], diff, title="Changes"))
+        elif row.get("status") == "draft":
+            output.info("The diff is frozen at submit; a draft shows it in the dashboard's Preview tab.")
+
+
+# ── acting ───────────────────────────────────────────────────────────────────
+
+@dataclass
+class VerbResult:
+    verb: str
+    service_name: str
+    config_code: str
+    rows: list[dict]
+
+    def to_dict(self) -> dict:
+        return {
+            "verb": self.verb, "service": self.service_name, "service_config_code": self.config_code,
+            "requests": [{"code": r.get("code"), "kind": kind_of(r), "status": r.get("status")} for r in self.rows],
+        }
+
+
+def run_verb(inv: Invocation, res: Resolver, verb: str, ref: str, *, env: str | None, region: str | None, comment: str) -> VerbResult:
+    from_statuses = VERB_FROM[verb]
+    target, rows = find_requests(inv, res, ref, env=env, region=region, statuses=from_statuses, mine_only=verb in AUTHOR_VERBS)
+    if not rows:
+        raise CliError(
+            f"No {' or '.join(from_statuses)} request of yours on {target.service_name}" if verb in AUTHOR_VERBS
+            else f"No {' or '.join(from_statuses)} request on {target.service_name}",
+            EXIT_NOT_FOUND, hint=f"`devlift request list --service {target.service_name}` shows what exists.",
+        )
+    wrong = [r for r in rows if r.get("status") not in from_statuses]
+    if wrong:
+        raise CliError(
+            f"{wrong[0]['code']} is {wrong[0]['status']} — only a {' or '.join(from_statuses)} request can be {verb}ed.".replace("eed", "ed"),
+            EXIT_CONFLICT,
+        )
+    if verb in ("request-changes", "reject") and not comment.strip():
+        raise InputError(f"{verb} needs a comment telling the author why.", hint="Pass --comment.")
+
+    if inv.show_summary:
+        for r in rows:
+            full = approvals_api.get_request(inv.api, r["code"])
+            print_request(full, with_diff=verb != "discard")
+    inv.confirm(f"{verb.capitalize().replace('-', ' ')} this change on {target.service_name} ({len(rows)} request{'s' if len(rows) > 1 else ''})?")
+
+    approvals_api.act(inv.api, rows[0]["code"], verb, comment)
+    after: list[dict] = []
+    for r in rows:
+        try:
+            after.append(approvals_api.get_request(inv.api, r["code"]))
+        except CliError:
+            after.append({**r, "status": "discarded"})      # gone from every read
+    for r in after:
+        output.info(f"{r['code']} ({kind_of(r)}): {VERB_DONE[verb]}.")
+    return VerbResult(verb, target.service_name, target.config_code, after)
+
+
+# ── deploy ───────────────────────────────────────────────────────────────────
+
+@dataclass
+class DeployResult:
+    service_name: str
+    config_code: str
+    environment: str | None
+    rows: list[dict]
+    workflow_id: str | None
+    status: str | None
+    state: dict | None = None
+
+    def to_dict(self) -> dict:
+        return {
+            "service": self.service_name, "service_config_code": self.config_code, "environment": self.environment,
+            "requests": [{"code": r.get("code"), "kind": kind_of(r)} for r in self.rows],
+            "workflow_id": self.workflow_id, "status": self.status, "state": self.state,
+        }
+
+
+def deploy(inv: Invocation, res: Resolver, service: str, *, env: str | None, region: str | None,
+           confirm_name: str | None, do_wait: bool) -> DeployResult:
+    target = resolve_target(inv, res, service, env, region)
+    rows = [r for r in approvals_api.list_requests(inv.api, resource_code=target.config_code) if r.get("status") == "approved"]
+    if not rows:
+        raise CliError(f"Nothing approved to deploy on {target.service_name} ({target.environment}).", EXIT_NOT_FOUND,
+                       hint=f"`devlift request list --service {target.service_name}` shows where it stands.")
+    if any((r.get("you") or {}).get("deploy_in_flight") for r in rows):
+        raise CliError(f"A deployment of {target.service_name} is already in progress.", EXIT_CONFLICT)
+    if not all((r.get("you") or {}).get("can_deploy", True) for r in rows):
+        raise CliError(f"You are not allowed to deploy {target.service_name} in {target.environment}.", 4)
+
+    if inv.show_summary:
+        output.err_console.print(kv_table([
+            ("Service", f"{target.service_name}  ({target.environment} / {target.region_name})"),
+            ("Configuration", target.config_code),
+        ] + [(f"Approved {kind_of(r).lower()}", f"{r['code']} by {r.get('requested_by_name') or r.get('requested_by')}") for r in rows], title="Deploy"))
+        # What is actually about to ship, not just which rows. This is the last
+        # point where the values can still be looked at, and the approved
+        # snapshot is exactly what the pipeline renders — so show the same
+        # Deployed → Requested table the reviewer decided on.
+        for row in rows:
+            try:
+                full = approvals_api.get_request(inv.api, row["code"])
+            except CliError:
+                continue
+            output.err_console.print(rows_table(
+                ["Field", "Deployed", "Requested"],
+                diff_rows(full) or [("–", "–", "no field-level changes recorded")],
+                title=f"{kind_of(full)} · {full.get('code')}",
+            ))
+    if (target.environment or "").lower() == "prod":
+        # Production: the service name has to be typed, as the dashboard and the
+        # assistant require. --yes alone is not enough here.
+        typed = confirm_name
+        if typed is None:
+            if not inv.interactive:
+                raise CliError("Deploying to production needs the service name typed back.", 5,
+                               hint=f"Pass --confirm-name {target.service_name}.")
+            typed = inv.ask(f"Type the service name to deploy to PRODUCTION ({target.service_name})", flag="--confirm-name")
+        if typed.strip() != target.service_name:
+            raise InputError(f"'{typed}' does not match {target.service_name}. Nothing was deployed.")
+    else:
+        inv.confirm(f"Deploy {target.service_name} to {target.environment}?")
+
+    started = approvals_api.multiple_deploy(inv.api, target.config_code) or {}
+    workflow_id = started.get("workflow_id")
+    output.info(f"Deployment of {target.service_name} to {target.environment} started" + (f" (workflow {workflow_id})." if workflow_id else "."))
+    result = DeployResult(target.service_name, target.config_code, target.environment, rows, workflow_id, started.get("status"))
+    if do_wait and workflow_id:
+        result.state = wait_for_multiple_deploy(inv, workflow_id, label=f"deploying {target.service_name}")
+        result.status = str((result.state or {}).get("step") or result.status)
+    return result
+
+
+_ORCH_STEPS = {
+    "preparing": "preparing", "acquiring_locks": "acquiring locks", "deploying_variables": "deploying variables",
+    "deploying_infra": "deploying the service", "completed": "done", "failed": "failed",
+}
+
+
+def wait_for_multiple_deploy(inv: Invocation, workflow_id: str, label: str) -> dict:
+    """Follow the orchestrator: its own steps, then the infra child workflow's
+    granular steps once it exists."""
+    last: dict = {}
+    hiccups = 0
+
+    def describe():
+        nonlocal last, hiccups
+        try:
+            last = approvals_api.multiple_deploy_status(inv.api, workflow_id) or {}
+            hiccups = 0
+        except CliError as exc:
+            if not getattr(exc, "transient", False) or hiccups >= 12:
+                raise
+            hiccups += 1
+            return f"waiting for status (status service busy, retry {hiccups})", False, False
+        step = str(last.get("step") or "").lower()
+        text = _ORCH_STEPS.get(step, step or "starting")
+        child = last.get("infra_workflow_id") or last.get("infra_child_workflow_id")
+        if child and step == "deploying_infra":
+            try:
+                from devlift_cli.api import infra
+                sub = infra.deploy_status(inv.api, child) or {}
+                sub_step = str(sub.get("step") or "").lower()
+                text += ": " + wait._STEP_TEXT.get(sub_step, sub_step or "starting")
+                if sub.get("pr_number") and sub.get("repo_full_name"):
+                    text += f" (PR #{sub['pr_number']} on {sub['repo_full_name']})"
+            except CliError:
+                pass
+        failed = step == "failed"
+        if failed and last.get("error"):
+            text += f": {last['error']}"
+        return text, failed or step == "completed", failed
+
+    wait.poll(describe, label=label)
+    return last