urun-cli 0.1.1__py3-none-any.whl

urun/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.1.0"

urun/api.py

@@ -0,0 +1,189 @@
+from __future__ import annotations
+
+import json
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor, as_completed
+from typing import Any
+
+from . import __version__
+from .errors import ApiError, UrunError
+from .manifest import FileBlob, hash_file
+
+DEFAULT_API_URL = "https://api.urun.sh/v1"
+
+
+class ApiClient:
+    def __init__(self, base_url: str, api_key: str, timeout: float = 30.0, attempts: int = 3):
+        require_safe_url(base_url, "API URL")
+        self.base_url = base_url.rstrip("/")
+        self.api_key = api_key
+        self.timeout = timeout
+        self.attempts = attempts
+
+    def register_manifest(self, manifest: dict[str, Any]) -> dict[str, Any]:
+        return self._json("POST", "/register-manifest", manifest)
+
+    def finalize(self, manifest_hash: str) -> dict[str, Any]:
+        return self._json("POST", f"/finalize/{manifest_hash}", None)
+
+    def deployment_status(self, manifest_hash: str) -> dict[str, Any]:
+        return self._json("GET", f"/deployment-status/{manifest_hash}", None)
+
+    def _json(self, method: str, path: str, body: dict[str, Any] | None) -> dict[str, Any]:
+        data = (
+            None
+            if body is None
+            else json.dumps(body, sort_keys=True, separators=(",", ":")).encode("utf-8")
+        )
+        payload = b""
+        for attempt in range(1, self.attempts + 1):
+            req = urllib.request.Request(
+                self.base_url + path,
+                data=data,
+                method=method,
+                headers={
+                    "Authorization": f"Bearer {self.api_key}",
+                    "Accept": "application/json",
+                    "Content-Type": "application/json",
+                    "User-Agent": f"urun-cli/{__version__}",
+                },
+            )
+            try:
+                with urllib.request.urlopen(req, timeout=self.timeout) as resp:
+                    payload = resp.read()
+                    break
+            except urllib.error.HTTPError as exc:
+                payload = exc.read()
+                code = "http_error"
+                message = payload.decode("utf-8", "replace") or exc.reason
+                try:
+                    parsed = json.loads(payload.decode("utf-8"))
+                    err = parsed.get("error") or {}
+                    code = err.get("code") or code
+                    message = err.get("message") or message
+                except Exception:
+                    pass
+                if exc.code not in {429, 500, 502, 503, 504} or attempt == self.attempts:
+                    raise ApiError(exc.code, code, message) from exc
+            except (urllib.error.URLError, TimeoutError) as exc:
+                if attempt == self.attempts:
+                    reason = getattr(exc, "reason", exc)
+                    raise UrunError(f"network error: {reason}") from exc
+            time.sleep(0.25 * attempt)
+        if not payload:
+            return {}
+        try:
+            return json.loads(payload.decode("utf-8"))
+        except json.JSONDecodeError as exc:
+            raise UrunError("invalid JSON response from urun API") from exc
+
+
+def upload_missing_blobs(
+    missing_blobs: list[dict[str, Any]], by_sha: dict[str, FileBlob], concurrency: int = 8
+) -> None:
+    if not missing_blobs:
+        return
+    if concurrency < 1:
+        raise UrunError("upload concurrency must be at least 1")
+    with ThreadPoolExecutor(max_workers=concurrency) as executor:
+        futures = []
+        seen: set[str] = set()
+        for item in missing_blobs:
+            if not isinstance(item, dict):
+                raise UrunError("invalid missing_blobs item from server")
+            sha = item.get("sha256")
+            upload_url = item.get("upload_url")
+            if not isinstance(sha, str) or not isinstance(upload_url, str):
+                raise UrunError("invalid missing_blobs item from server")
+            if sha in seen:
+                continue
+            seen.add(sha)
+            if sha not in by_sha:
+                raise UrunError(f"server requested unknown blob: {sha}")
+            futures.append(executor.submit(upload_blob, upload_url, by_sha[sha]))
+        for fut in as_completed(futures):
+            fut.result()
+
+
+def upload_blob(upload_url: str, blob: FileBlob, attempts: int = 3) -> None:
+    require_safe_url(upload_url, "upload URL")
+    current_sha, current_size = hash_file(blob.source)
+    if current_sha != blob.sha256 or current_size != blob.size:
+        raise UrunError(f"file changed after manifest generation: {blob.path}")
+    last_error: Exception | None = None
+    for attempt in range(1, attempts + 1):
+        try:
+            with blob.source.open("rb") as f:
+                req = urllib.request.Request(
+                    upload_url,
+                    data=f,
+                    method="PUT",
+                    headers={
+                        "Content-Length": str(blob.size),
+                        "If-None-Match": "*",
+                    },
+                )
+                with urllib.request.urlopen(req, timeout=120) as resp:
+                    if resp.status >= 300:
+                        raise UrunError(f"upload failed for {blob.path}: HTTP {resp.status}")
+                    return
+        except urllib.error.HTTPError as exc:
+            if exc.code == 412:
+                # Another identical deploy may have won the content-addressed race.
+                return
+            if exc.code < 500 or attempt == attempts:
+                raise UrunError(
+                    f"upload failed for {blob.path}: HTTP {exc.code} {exc.reason}"
+                ) from exc
+            last_error = exc
+        except (urllib.error.URLError, TimeoutError) as exc:
+            if attempt == attempts:
+                reason = getattr(exc, "reason", exc)
+                raise UrunError(f"upload failed for {blob.path}: {reason}") from exc
+            last_error = exc
+        time.sleep(0.25 * attempt)
+    if last_error is not None:
+        raise UrunError(f"upload failed for {blob.path}: {last_error}") from last_error
+
+
+def require_safe_url(raw_url: str, label: str) -> None:
+    parsed = urllib.parse.urlparse(raw_url)
+    host = (parsed.hostname or "").lower()
+    if parsed.scheme == "https":
+        return
+    if parsed.scheme == "http" and host in {"127.0.0.1", "localhost", "::1"}:
+        return
+    raise UrunError(f"{label} must use HTTPS except for localhost development")
+
+
+def poll_until_done(
+    client: ApiClient,
+    manifest_hash: str,
+    interval: float = 2.0,
+    timeout: float = 1800.0,
+    not_found_grace: float = 30.0,
+) -> dict[str, Any]:
+    deadline = time.time() + timeout
+    not_found_deadline = time.time() + min(not_found_grace, timeout)
+    last_state = "unknown"
+    while True:
+        try:
+            status = client.deployment_status(manifest_hash)
+        except ApiError as exc:
+            if exc.status == 404 and time.time() < not_found_deadline:
+                last_state = "not_found"
+                time.sleep(interval)
+                continue
+            raise
+        state = status.get("status")
+        last_state = str(state)
+        if state in {"ready", "failed"}:
+            return status
+        if time.time() >= deadline:
+            raise UrunError(
+                f"timed out waiting for deployment {manifest_hash} (last status: {last_state})"
+            )
+        time.sleep(interval)

urun/cli.py

@@ -0,0 +1,148 @@
+from __future__ import annotations
+
+import argparse
+import os
+import re
+import sys
+from datetime import UTC, datetime
+from pathlib import Path
+from typing import Any
+
+from . import __version__
+from .api import DEFAULT_API_URL, ApiClient, poll_until_done, upload_missing_blobs
+from .config import load_config
+from .deps import resolve_deps
+from .discovery import derive_app_name, discover_main_files, discover_mounts
+from .errors import UrunError
+from .manifest import manifest_hash, unique_blobs
+
+API_KEY_RE = re.compile(r"^urun_[0-9a-f]{32}$")
+ORG_ID_RE = re.compile(r"^org_[A-Za-z0-9_-]+$")
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    try:
+        if args.command == "deploy":
+            return deploy(args)
+        parser.print_help()
+        return 2
+    except UrunError as exc:
+        print(f"error: {exc}", file=sys.stderr)
+        return 1
+    except KeyboardInterrupt:
+        print("aborted", file=sys.stderr)
+        return 130
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(prog="urun")
+    parser.add_argument("--version", action="version", version=f"urun {__version__}")
+    sub = parser.add_subparsers(dest="command")
+    deploy = sub.add_parser("deploy", help="Deploy a Python app to urun")
+    target = deploy.add_mutually_exclusive_group()
+    target.add_argument("entrypoint", nargs="?", help="Python file entrypoint, e.g. app.py")
+    target.add_argument("-m", "--module", help="Python module entrypoint, e.g. myapp.main")
+    deploy.add_argument("--name", help="App name (defaults from entrypoint/module)")
+    deploy.add_argument("--config", type=Path, help="Path to urun.toml")
+    deploy.add_argument(
+        "--api-url", default=os.getenv("URUN_API_URL", DEFAULT_API_URL), help="API base URL"
+    )
+    deploy.add_argument(
+        "--api-key", default=os.getenv("URUN_API_KEY"), help="API key (or URUN_API_KEY)"
+    )
+    deploy.add_argument(
+        "--org-id", default=os.getenv("URUN_ORG_ID"), help="Org id (or URUN_ORG_ID)"
+    )
+    deploy.add_argument(
+        "--no-wait", action="store_true", help="Finalize deployment but do not poll for readiness"
+    )
+    deploy.add_argument("--poll-interval", type=float, default=2.0)
+    deploy.add_argument("--timeout", type=float, default=1800.0)
+    return parser
+
+
+def deploy(args: argparse.Namespace) -> int:
+    if not args.api_key:
+        raise UrunError("missing API key; set URUN_API_KEY or pass --api-key")
+    if not API_KEY_RE.fullmatch(args.api_key):
+        raise UrunError("invalid API key format; expected urun_<32 lowercase hex chars>")
+    if not args.org_id:
+        raise UrunError("missing org id; set URUN_ORG_ID or pass --org-id")
+    if not ORG_ID_RE.fullmatch(args.org_id):
+        raise UrunError("invalid org id format; expected org_<id>")
+    if args.poll_interval <= 0:
+        raise UrunError("--poll-interval must be greater than 0")
+    if args.timeout <= 0:
+        raise UrunError("--timeout must be greater than 0")
+
+    project_root = args.config.resolve().parent if args.config else Path.cwd()
+    config = load_config(args.config)
+    entrypoint, files = discover_main_files(config, args.entrypoint, args.module, project_root)
+    mount_entries, mount_blobs = discover_mounts(config.mounts, project_root)
+    deps, deps_blob, python_version = resolve_deps(config, project_root)
+
+    app_name = (
+        args.name
+        or config.app.name
+        or derive_app_name(
+            args.entrypoint or config.app.entrypoint, args.module or config.app.module
+        )
+    )
+    all_blobs = files + mount_blobs + ([deps_blob] if deps_blob is not None else [])
+    manifest = {
+        "version": 1,
+        "org_id": args.org_id,
+        "app_name": app_name,
+        "entrypoint": entrypoint,
+        "python_version": python_version,
+        "files": [b.manifest_entry() for b in sorted(files, key=lambda b: b.path)],
+        "mounts": mount_entries,
+        "deps": deps,
+        "created_at": datetime.now(UTC).replace(microsecond=0).isoformat().replace("+00:00", "Z"),
+        "client_version": f"urun-cli/{__version__}",
+    }
+    mh = manifest_hash(manifest)
+
+    print(f"Deploying {app_name} ({mh[:12]})")
+    print(f"Files: {len(files)} app, {len(mount_blobs)} mounted, deps: {deps['kind']}")
+
+    client = ApiClient(args.api_url, args.api_key)
+    register = client.register_manifest(manifest)
+    server_hash = register.get("manifest_hash")
+    if server_hash and server_hash != mh:
+        raise UrunError(f"server manifest hash mismatch: local {mh}, server {server_hash}")
+    missing = register.get("missing_blobs", [])
+    print(f"Uploading {len(missing)} missing blob(s)")
+    upload_missing_blobs(missing, unique_blobs(all_blobs))
+
+    final = client.finalize(mh)
+    print(f"Deployment {final.get('status', 'queued')}: {mh}")
+    if args.no_wait:
+        status_url = register.get("status_url")
+        if status_url:
+            print(f"Status: {status_url}")
+        return 0
+
+    status = poll_until_done(client, mh, args.poll_interval, args.timeout)
+    if status.get("status") == "failed":
+        err = status.get("error") or {}
+        code = err.get("code")
+        message = err.get("message")
+        detail = f"{code}: {message}" if code and message else (message or code or "unknown error")
+        raise UrunError(f"deployment failed: {detail}")
+    print_ready(status)
+    return 0
+
+
+def print_ready(status: dict[str, Any]) -> None:
+    print("Deployment ready")
+    if status.get("zerofs_path"):
+        print(f"ZeroFS: {status['zerofs_path']}")
+    if status.get("url"):
+        print(f"URL: {status['url']}")
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

urun/config.py

@@ -0,0 +1,115 @@
+from __future__ import annotations
+
+import re
+import tomllib
+from dataclasses import dataclass, field
+from pathlib import Path, PurePosixPath
+from typing import Any
+
+from .errors import UrunError
+
+
+@dataclass
+class AppConfig:
+    name: str | None = None
+    entrypoint: str | None = None
+    module: str | None = None
+    python_version: str | None = None
+
+
+@dataclass
+class MountConfig:
+    local_path: str | None = None
+    local_file: str | None = None
+    python_source: str | None = None
+    remote_path: str | None = None
+
+
+@dataclass
+class DepsConfig:
+    requirements: str | None = None
+
+
+@dataclass
+class UrunConfig:
+    app: AppConfig = field(default_factory=AppConfig)
+    mounts: list[MountConfig] = field(default_factory=list)
+    deps: DepsConfig = field(default_factory=DepsConfig)
+
+
+def load_config(path: Path | None) -> UrunConfig:
+    if path is None:
+        path = Path("urun.toml")
+    if not path.exists():
+        return UrunConfig()
+    try:
+        data = tomllib.loads(path.read_text())
+    except tomllib.TOMLDecodeError as exc:
+        raise UrunError(f"Invalid TOML in {path}: {exc}") from exc
+    return parse_config(data, path)
+
+
+def parse_config(data: dict[str, Any], path: Path = Path("urun.toml")) -> UrunConfig:
+    app_data = data.get("app", {}) or {}
+    if not isinstance(app_data, dict):
+        raise UrunError(f"{path}: [app] must be a table")
+    app = AppConfig(
+        name=_str(app_data, "name", path),
+        entrypoint=_str(app_data, "entrypoint", path),
+        module=_str(app_data, "module", path),
+        python_version=_str(app_data, "python_version", path),
+    )
+
+    mounts: list[MountConfig] = []
+    for idx, mount_data in enumerate(data.get("mounts", []) or []):
+        if not isinstance(mount_data, dict):
+            raise UrunError(f"{path}: [[mounts]] item {idx} must be a table")
+        sources = [k for k in ("local_path", "local_file", "python_source") if mount_data.get(k)]
+        if len(sources) != 1:
+            raise UrunError(f"{path}: [[mounts]] item {idx} must set exactly one source")
+        remote_path = _str(mount_data, "remote_path", path)
+        if not remote_path:
+            raise UrunError(f"{path}: [[mounts]] item {idx} must set remote_path")
+        validate_remote_path(remote_path, path, idx)
+        mounts.append(
+            MountConfig(
+                local_path=_str(mount_data, "local_path", path),
+                local_file=_str(mount_data, "local_file", path),
+                python_source=_str(mount_data, "python_source", path),
+                remote_path=remote_path,
+            )
+        )
+
+    deps_data = data.get("deps", {}) or {}
+    if not isinstance(deps_data, dict):
+        raise UrunError(f"{path}: [deps] must be a table")
+    return UrunConfig(
+        app=app, mounts=mounts, deps=DepsConfig(requirements=_str(deps_data, "requirements", path))
+    )
+
+
+def validate_remote_path(remote_path: str, path: Path, idx: int) -> None:
+    parts = PurePosixPath(remote_path).parts
+    invalid = (
+        not remote_path.startswith("/")
+        or remote_path == "/"
+        or "\\" in remote_path
+        or "//" in remote_path
+        or any(part in {".", ".."} for part in parts)
+        or any(part in {".", ".."} for part in remote_path.split("/"))
+        or bool(re.search(r"[\x00-\x1f\x7f]", remote_path))
+        or len(remote_path) > 512
+    )
+    if invalid:
+        raise UrunError(
+            f"{path}: [[mounts]] item {idx} remote_path must be an absolute, normalized POSIX path"
+        )
+
+
+def _str(data: dict[str, Any], key: str, path: Path) -> str | None:
+    value = data.get(key)
+    if value is None:
+        return None
+    if not isinstance(value, str):
+        raise UrunError(f"{path}: {key} must be a string")
+    return value

urun/deps.py

@@ -0,0 +1,92 @@
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+from typing import Any
+
+from .config import UrunConfig
+from .discovery import ensure_under_root
+from .errors import UrunError
+from .manifest import FileBlob, file_blob
+
+DEFAULT_PYTHON_VERSION = "3.12"
+CREDENTIAL_URL_RE = re.compile(r"https?://[^\s/@:]+:[^\s/@]+@", re.IGNORECASE)
+
+
+def resolve_deps(
+    config: UrunConfig, project_root: Path
+) -> tuple[dict[str, Any], FileBlob | None, str]:
+    python_version = config.app.python_version or DEFAULT_PYTHON_VERSION
+    if config.deps.requirements:
+        path = ensure_under_root(
+            project_root / config.deps.requirements, project_root, "requirements file"
+        )
+        if not path.is_file():
+            raise UrunError(f"requirements file not found: {path}")
+        reject_embedded_dependency_credentials(path)
+        blob = file_blob(path, project_root)
+        return (
+            {
+                "kind": "requirements_txt",
+                "blob_sha256": blob.sha256,
+                "python_version": python_version,
+            },
+            blob,
+            python_version,
+        )
+
+    pyproject = project_root / "pyproject.toml"
+    if pyproject.is_file():
+        reject_embedded_dependency_credentials(pyproject)
+        blob = file_blob(pyproject, project_root)
+        try:
+            data = tomllib.loads(pyproject.read_text())
+        except tomllib.TOMLDecodeError as exc:
+            raise UrunError(f"Invalid TOML in pyproject.toml: {exc}") from exc
+        requires = (data.get("project") or {}).get("requires-python")
+        if not config.app.python_version and isinstance(requires, str):
+            python_version = python_from_requires(requires) or python_version
+        return (
+            {
+                "kind": "pyproject_toml",
+                "blob_sha256": blob.sha256,
+                "python_version": python_version,
+            },
+            blob,
+            python_version,
+        )
+
+    req = project_root / "requirements.txt"
+    if req.is_file():
+        reject_embedded_dependency_credentials(req)
+        blob = file_blob(req, project_root)
+        return (
+            {
+                "kind": "requirements_txt",
+                "blob_sha256": blob.sha256,
+                "python_version": python_version,
+            },
+            blob,
+            python_version,
+        )
+
+    return {"kind": "none", "python_version": python_version}, None, python_version
+
+
+def reject_embedded_dependency_credentials(path: Path) -> None:
+    text = path.read_text(errors="ignore")
+    if CREDENTIAL_URL_RE.search(text):
+        raise UrunError(
+            f"dependency file contains an embedded credential URL: {path.name}; "
+            "use token-free package references before deploying"
+        )
+
+
+def python_from_requires(spec: str) -> str | None:
+    # Conservative extraction for common specs such as >=3.11 or ==3.12.*.
+    versions = re.findall(r"(\d+)\.(\d+)", spec)
+    if not versions:
+        return None
+    major, minor = versions[0]
+    return f"{major}.{minor}"

urun/discovery.py

@@ -0,0 +1,204 @@
+from __future__ import annotations
+
+import fnmatch
+import importlib.util
+import sys
+from pathlib import Path
+
+from .config import MountConfig, UrunConfig
+from .errors import UrunError
+from .manifest import FileBlob, file_blob
+
+MAX_AUTO_INCLUDE_BYTES = 50 * 1024 * 1024
+DEFAULT_PYTHON_VERSION = "3.12"
+
+
+def derive_app_name(entrypoint: str | None, module: str | None) -> str:
+    if module:
+        return module.split(".")[0]
+    if not entrypoint:
+        raise UrunError("missing entrypoint")
+    p = Path(entrypoint)
+    if p.name == "__main__.py" and p.parent.name:
+        return p.parent.name
+    if p.parent != Path("."):
+        return p.parent.name
+    return p.stem
+
+
+def package_root_for(entrypoint: Path) -> Path | None:
+    current = entrypoint.resolve().parent
+    if not (current / "__init__.py").exists():
+        return None
+    root = current
+    while (root.parent / "__init__.py").exists():
+        root = root.parent
+    return root
+
+
+def load_urunignore(root: Path) -> list[str]:
+    ignore = root / ".urunignore"
+    if not ignore.exists():
+        return []
+    return [
+        line.strip()
+        for line in ignore.read_text().splitlines()
+        if line.strip() and not line.lstrip().startswith("#")
+    ]
+
+
+def is_ignored(path: Path, project_root: Path, patterns: list[str]) -> bool:
+    try:
+        rel = path.resolve().relative_to(project_root.resolve()).as_posix()
+    except ValueError as exc:
+        raise UrunError(f"path is outside the project root: {path}") from exc
+    parts = rel.split("/")
+    if any(part == "__pycache__" for part in parts):
+        return True
+    if any(part == ".git" for part in parts):
+        return True
+    if path.name.startswith(".") or any(part.startswith(".") for part in parts):
+        return True
+    if path.suffix == ".pyc":
+        return True
+    return any(
+        fnmatch.fnmatch(rel, pattern) or fnmatch.fnmatch(path.name, pattern) for pattern in patterns
+    )
+
+
+def auto_include(entrypoint: Path, project_root: Path) -> list[FileBlob]:
+    if not entrypoint.exists() or not entrypoint.is_file():
+        raise UrunError(f"entrypoint not found: {entrypoint}")
+    if entrypoint.suffix != ".py":
+        raise UrunError("entrypoint must be a .py file")
+    patterns = load_urunignore(project_root)
+    pkg = package_root_for(entrypoint)
+    files: list[Path]
+    if pkg:
+        files = sorted(
+            p
+            for p in pkg.rglob("*.py")
+            if p.is_file() and not is_ignored(p, project_root, patterns)
+        )
+        total = sum(p.stat().st_size for p in files)
+        if total > MAX_AUTO_INCLUDE_BYTES:
+            raise UrunError(
+                f"auto-included package {pkg} is {total} bytes, above 50 MB; "
+                "use urun.toml to configure explicit mounts"
+            )
+    else:
+        if is_ignored(entrypoint, project_root, patterns):
+            raise UrunError(f"entrypoint is ignored by defaults or .urunignore: {entrypoint}")
+        files = [entrypoint]
+    blobs: list[FileBlob] = []
+    for p in files:
+        try:
+            blobs.append(file_blob(p, project_root))
+        except ValueError as exc:
+            raise UrunError(f"path is outside the project root: {p}") from exc
+    return blobs
+
+
+def discover_main_files(
+    config: UrunConfig, entrypoint_arg: str | None, module_arg: str | None, project_root: Path
+) -> tuple[str, list[FileBlob]]:
+    ensure_project_on_path(project_root)
+    module = module_arg or config.app.module
+    entrypoint = entrypoint_arg or config.app.entrypoint
+    if module:
+        spec = importlib.util.find_spec(module)
+        if spec is None or spec.origin is None:
+            raise UrunError(f"module not found: {module}")
+        entrypoint_path = ensure_under_root(Path(spec.origin), project_root, "module")
+    elif entrypoint:
+        entrypoint_path = Path(entrypoint)
+    else:
+        raise UrunError("provide an entrypoint, -m module, or [app].entrypoint in urun.toml")
+    if not entrypoint_path.is_absolute():
+        entrypoint_path = project_root / entrypoint_path
+    files = auto_include(entrypoint_path, project_root)
+    try:
+        manifest_entrypoint = (
+            module
+            if module
+            else entrypoint_path.resolve().relative_to(project_root.resolve()).as_posix()
+        )
+    except ValueError as exc:
+        raise UrunError(f"entrypoint is outside the project root: {entrypoint_path}") from exc
+    return manifest_entrypoint, files
+
+
+def discover_mounts(
+    mounts: list[MountConfig], project_root: Path
+) -> tuple[list[dict], list[FileBlob]]:
+    ensure_project_on_path(project_root)
+    manifest_mounts: list[dict] = []
+    all_blobs: list[FileBlob] = []
+    patterns = load_urunignore(project_root)
+    seen_remote_paths: set[str] = set()
+    for mount in mounts:
+        if mount.remote_path in seen_remote_paths:
+            raise UrunError(f"duplicate mount remote_path: {mount.remote_path}")
+        seen_remote_paths.add(str(mount.remote_path))
+        source = _mount_source(mount, project_root)
+        assert mount.remote_path is not None
+        if mount.local_file:
+            if not source.is_file():
+                raise UrunError(f"mount file not found: {source}")
+            blob = file_blob(source, source.parent, source.name)
+            entries = [blob]
+        else:
+            if not source.is_dir():
+                raise UrunError(f"mount directory not found: {source}")
+            paths = sorted(
+                p
+                for p in source.rglob("*")
+                if p.is_file() and not is_ignored(p, project_root, patterns)
+            )
+            entries = [file_blob(p, source) for p in paths]
+        all_blobs.extend(entries)
+        manifest_mounts.append(
+            {
+                "remote_path": mount.remote_path,
+                "files": [b.manifest_entry() for b in sorted(entries, key=lambda b: b.path)],
+            }
+        )
+    return manifest_mounts, all_blobs
+
+
+def ensure_project_on_path(project_root: Path) -> None:
+    candidates = [project_root.resolve()]
+    src = project_root / "src"
+    if src.is_dir():
+        candidates.append(src.resolve())
+    for candidate in reversed(candidates):
+        path = str(candidate)
+        if path not in sys.path:
+            sys.path.insert(0, path)
+
+
+def ensure_under_root(path: Path, project_root: Path, label: str = "path") -> Path:
+    resolved = path.resolve()
+    try:
+        resolved.relative_to(project_root.resolve())
+    except ValueError as exc:
+        raise UrunError(f"{label} is outside the project root: {path}") from exc
+    return resolved
+
+
+def _mount_source(mount: MountConfig, project_root: Path) -> Path:
+    if mount.local_path:
+        return ensure_under_root(project_root / mount.local_path, project_root, "mount path")
+    if mount.local_file:
+        return ensure_under_root(project_root / mount.local_file, project_root, "mount file")
+    if mount.python_source:
+        spec = importlib.util.find_spec(mount.python_source)
+        if spec is None:
+            raise UrunError(f"python_source not found: {mount.python_source}")
+        if spec.submodule_search_locations:
+            return ensure_under_root(
+                Path(next(iter(spec.submodule_search_locations))), project_root, "python_source"
+            )
+        if spec.origin:
+            return ensure_under_root(Path(spec.origin), project_root, "python_source")
+    raise UrunError("invalid mount source")

urun/errors.py

@@ -0,0 +1,10 @@
+class UrunError(Exception):
+    """User-facing CLI error."""
+
+
+class ApiError(UrunError):
+    def __init__(self, status: int, code: str, message: str):
+        super().__init__(f"{status} {code}: {message}")
+        self.status = status
+        self.code = code
+        self.message = message

urun/manifest.py

@@ -0,0 +1,78 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from collections.abc import Iterable
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+
+
+@dataclass(frozen=True)
+class FileBlob:
+    path: str
+    source: Path
+    sha256: str
+    size: int
+    mode: int
+
+    def manifest_entry(self) -> dict[str, Any]:
+        return {
+            "path": self.path,
+            "sha256": self.sha256,
+            "size": self.size,
+            "mode": self.mode,
+        }
+
+
+def posix_rel(path: Path, root: Path) -> str:
+    return path.resolve().relative_to(root.resolve()).as_posix()
+
+
+def normalized_mode(path: Path) -> int:
+    st_mode = path.stat().st_mode
+    return 0o100755 if (st_mode & 0o111) else 0o100644
+
+
+def hash_file(path: Path, chunk_size: int = 1024 * 1024) -> tuple[str, int]:
+    h = hashlib.sha256()
+    size = 0
+    with path.open("rb") as f:
+        while True:
+            chunk = f.read(chunk_size)
+            if not chunk:
+                break
+            size += len(chunk)
+            h.update(chunk)
+    return h.hexdigest(), size
+
+
+def file_blob(path: Path, root: Path, manifest_path: str | None = None) -> FileBlob:
+    sha, size = hash_file(path)
+    return FileBlob(
+        path=manifest_path or posix_rel(path, root),
+        source=path.resolve(),
+        sha256=sha,
+        size=size,
+        mode=normalized_mode(path),
+    )
+
+
+def canonical_json(data: dict[str, Any]) -> bytes:
+    """Canonical JSON: sorted keys, compact separators, UTF-8, no trailing whitespace."""
+    return json.dumps(data, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode(
+        "utf-8"
+    )
+
+
+def manifest_hash(manifest_without_hash: dict[str, Any]) -> str:
+    data = dict(manifest_without_hash)
+    data.pop("manifest_hash", None)
+    return hashlib.sha256(canonical_json(data)).hexdigest()
+
+
+def unique_blobs(files: Iterable[FileBlob]) -> dict[str, FileBlob]:
+    out: dict[str, FileBlob] = {}
+    for blob in files:
+        out.setdefault(blob.sha256, blob)
+    return out

urun_cli-0.1.1.dist-info/METADATA

@@ -0,0 +1,130 @@
+Metadata-Version: 2.4
+Name: urun-cli
+Version: 0.1.1
+Summary: End-user CLI for deploying apps to urun
+Project-URL: Homepage, https://urun.sh
+Project-URL: Repository, https://github.com/urun-sh/urun-cli
+Project-URL: Issues, https://github.com/urun-sh/urun-cli/issues
+Author: urun
+License-Expression: MIT
+License-File: LICENSE
+Keywords: cli,deploy,urun
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Software Development :: Build Tools
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+
+# urun CLI
+
+End-user command line client for deploying Python apps to urun.
+
+## Install
+
+```bash
+uv tool install urun-cli
+# or
+pip install urun-cli
+```
+
+The installed executable is still `urun`:
+
+```bash
+urun --version
+```
+
+PyPI does not allow the distribution name `urun`, so ephemeral uv runs need the
+package name explicitly:
+
+```bash
+uvx --from urun-cli urun --version
+# or use the package-matching alias
+uvx urun-cli --version
+```
+
+## Deploy
+
+```bash
+export URUN_API_KEY=urun_<32hex>
+export URUN_ORG_ID=org_...  # bootstrap-era requirement for v1 manifests
+urun deploy app.py
+```
+
+## Development with uv / Nix
+
+This repo includes `flake.nix` and `.envrc` for a reproducible dev shell with uv,
+Python 3.12, Dagger, actionlint, and pre-commit.
+
+```bash
+direnv allow  # optional, if you use direnv/nix
+uv sync
+uv run pytest
+uv run urun --version
+uv build
+```
+
+CI uses the same centralized Dagger pre-commit pipeline pattern as `urun`:
+`precommit.yaml` checks out `urun-sh/dagger-pipeline` and runs `recipes.precommit`.
+Normal `ci` remains self-contained and runs on public/fork PRs.
+
+Optional local MinIO integration test:
+
+```bash
+docker compose -f compose.minio.yml up -d
+URUN_TEST_MINIO_ENDPOINT=127.0.0.1:9000 \
+URUN_TEST_MINIO_ACCESS_KEY=minioadmin \
+URUN_TEST_MINIO_SECRET_KEY=minioadmin \
+uv run pytest -q -m minio
+```
+
+See `SPEC_TRACKING.md` for spec coverage and remaining gaps.
+
+## Configuration
+
+Configuration is read from `urun.toml` when present. CLI flags override config values.
+
+```toml
+[app]
+name = "my-app"
+entrypoint = "src/myapp/main.py"
+python_version = "3.12"
+
+[[mounts]]
+local_path = "./assets"
+remote_path = "/app/assets"
+
+[deps]
+requirements = "requirements.txt"
+```
+
+Common options:
+
+| Option | Description |
+| --- | --- |
+| `-m, --module` | Deploy a Python module entrypoint, e.g. `myapp.main`. |
+| `--name` | Override the derived app name. |
+| `--config` | Use a specific `urun.toml`; relative paths resolve from its directory. |
+| `--api-url` | Override the API URL. |
+| `--api-key` | API key; prefer `URUN_API_KEY` for shell history safety. |
+| `--org-id` | Bootstrap-era org ID required in v1 manifests. |
+| `--no-wait` | Finalize but do not poll for readiness. |
+| `--poll-interval`, `--timeout` | Control readiness polling. |
+
+## Troubleshooting
+
+| Error | Fix |
+| --- | --- |
+| `missing API key` | Set `URUN_API_KEY` or pass `--api-key`. |
+| `invalid API key format` | Use `urun_<32 lowercase hex chars>`. |
+| `missing org id` | Set `URUN_ORG_ID` while v1 bootstrap is manual. |
+| `entrypoint not found` | Run from the project root or pass `--config`. |
+| `path is outside the project root` | Move the file under the project or adjust `urun.toml`. |
+
+## License
+
+MIT. Local MinIO is used only as an optional S3-compatible test service.

urun_cli-0.1.1.dist-info/RECORD

@@ -0,0 +1,13 @@
+urun/__init__.py,sha256=kUR5RAFc7HCeiqdlX36dZOHkUI5wI6V_43RpEcD8b-0,22
+urun/api.py,sha256=NOti71DwAvV-SPvcDoQgt4Y0w4yIQX2QzYWjsRi3o4U,7468
+urun/cli.py,sha256=3OUW2DX1mZ1Cv6UIUEfSZGdSJ-8XijLoWGxAWGZiBk0,5727
+urun/config.py,sha256=uT-1NDs7ZB1rx15X-_n6XPrxvNF10yDjIQZRlhQXIcA,3769
+urun/deps.py,sha256=ZI7T1OlerKfYGdFNqVrsCF69B0GVCBydFt76XrYx7VI,3088
+urun/discovery.py,sha256=0xDgyjgh66aEK93kraZIm8x8r6naTYbn1GVAhZRQnzw,7446
+urun/errors.py,sha256=xd1UrFrqn5rQXcUX02_vfzHwHgpDA0RbwrbM_pnhaZY,293
+urun/manifest.py,sha256=YLpryYCFSu-w8yONj3oohBHpLNP-dPRYAny1JAe9pfI,2043
+urun_cli-0.1.1.dist-info/METADATA,sha256=Gw_DfOtO3-QhXdhcPbP2weDPZYrM1W2jx9QW0jDcPzk,3568
+urun_cli-0.1.1.dist-info/WHEEL,sha256=QccIxa26bgl1E6uMy58deGWi-0aeIkkangHcxk2kWfw,87
+urun_cli-0.1.1.dist-info/entry_points.txt,sha256=Hm1XEwW2k-vTyABcFkd8FevCaQHPz9CTOHxvXkiMiOs,64
+urun_cli-0.1.1.dist-info/licenses/LICENSE,sha256=e54RugXp4xrrinIGvXfGB3UBq__CoP32EEGPaju_G8I,1061
+urun_cli-0.1.1.dist-info/RECORD,,

urun_cli-0.1.1.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.29.0
+Root-Is-Purelib: true
+Tag: py3-none-any

urun_cli-0.1.1.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+urun = urun.cli:main
+urun-cli = urun.cli:main

urun_cli-0.1.1.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 urun
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.