wasm-cli 1.1.0__tar.gz → 1.2.0__tar.gz

{wasm_cli-1.1.0/src/wasm_cli.egg-info → wasm_cli-1.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wasm-cli
-Version: 1.1.0
+Version: 1.2.0
 Summary: Web App System Management - Deploy and manage web applications on Linux servers
 Author: Yago López Prado
 Author-email: Yago López Prado <yago.lopez.adeje@gmail.com>

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wasm-cli"
-version = "1.1.0"
+version = "1.2.0"
 description = "Web App System Management - Deploy and manage web applications on Linux servers"
 readme = "README.md"
 license = { text = "WASM-NCSAL" }

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/setup.py

@@ -9,7 +9,7 @@ from setuptools import setup, find_packages
 
 setup(
     name="wasm-cli",
-    version="1.1.0",
+    version="1.2.0",
     description="Web App System Management - Deploy and manage web applications on Linux servers",
     author="Yago López Prado",
     author_email="yago.lopez.adeje@gmail.com",

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/src/wasm/__init__.py

@@ -15,7 +15,7 @@ from importlib.metadata import version as _installed_version
 #: as an OBS build directory. The single source of truth is the ``version``
 #: field of pyproject.toml; ``scripts/release.py`` keeps this literal and the
 #: distribution packaging files in step with it.
-_FALLBACK_VERSION = "1.1.0"
+_FALLBACK_VERSION = "1.2.0"
 
 try:
     __version__ = _installed_version("wasm-cli")

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/src/wasm/cli/commands/web.py

@@ -40,7 +40,6 @@ Two structural notes about the Click migration:
 from __future__ import annotations
 
 import importlib.util
-import ipaddress
 import os
 import signal
 import socket
@@ -59,6 +58,13 @@ from wasm.cli.app import Context, enable_dry_run, pass_context
 from wasm.core.exceptions import SecurityError, WASMError
 from wasm.core.fs import get_fs
 from wasm.core.logger import Logger, set_colors_disabled
+from wasm.core.net import (
+    host_addresses,
+    is_loopback_host,
+    loopback_access_lines,
+    normalize_host,
+    strip_brackets,
+)
 from wasm.core.runner import get_runner
 
 if TYPE_CHECKING:
@@ -68,23 +74,18 @@ if TYPE_CHECKING:
 PID_FILE = Path("/var/run/wasm-web.pid")
 PID_FILE_USER = Path.home() / ".wasm" / "web.pid"
 
-#: The address a socket is given when it should answer on every interface. It
-#: is named here to be recognised and refused, never bound by default.
-ALL_INTERFACES = "0.0.0.0"  # noqa: S104
-
-#: Spellings of "every interface" that no resolver accepts, so they cannot be
-#: classified by looking them up. The empty string is the one that mattered: a
-#: version of this module kept a set of loopback *strings* with "" in it, and
-#: ``wasm web start --host ""`` walked past the refusal below and bound the
-#: root panel to every interface in cleartext.
-WILDCARD_SPELLINGS = frozenset({"", "*"})
-
 #: Package installation is slow on a cold cache but must not hang a session.
 INSTALL_TIMEOUT = 900
 
 #: Seconds between stopping and starting again, so the port is released.
 RESTART_PAUSE = 1
 
+#: How far past a taken port to look for a free one to name. The panel is not
+#: moved automatically - see :func:`_start` - but the port offered instead has
+#: to be one that will actually work, and the search has to finish while the
+#: operator is still reading the error.
+PORT_SUGGESTION_SPAN = 20
+
 F = TypeVar("F", bound=Callable[..., Any])
 
 
@@ -208,110 +209,6 @@ def _exit(code: int) -> NoReturn:
 # How the panel is exposed
 # ---------------------------------------------------------------------------
 
-#: Address family alias, for the helpers below.
-IPAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
-
-
-def _strip_brackets(host: str) -> str:
-    """
-    Remove the brackets an IPv6 literal is often written with.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The spelling without a surrounding ``[]`` pair.
-    """
-    candidate = host.strip()
-    if len(candidate) > 1 and candidate.startswith("[") and candidate.endswith("]"):
-        return candidate[1:-1]
-    return candidate
-
-
-def _host_addresses(host: str) -> tuple[IPAddress, ...]:
-    """
-    Return every address a host spelling would end up bound to.
-
-    Comparing host strings is what made this decision wrong: "" , "*", "0",
-    "0.0.0.0", "::" and a name in ``/etc/hosts`` pointing at 0.0.0.0 are six
-    spellings of the same socket, and a set of known-good strings misses five
-    of them. The resolver is asked instead, and its answer is classified with
-    :mod:`ipaddress`.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The addresses, empty when the spelling cannot be resolved. Empty means
-        "unknown", and every caller treats unknown as exposed.
-    """
-    candidate = _strip_brackets(host)
-    if candidate in WILDCARD_SPELLINGS:
-        return (ipaddress.ip_address(ALL_INTERFACES),)
-
-    try:
-        return (ipaddress.ip_address(candidate),)
-    except ValueError:
-        pass
-
-    try:
-        # A resolution covers names and also the inet_aton spellings ipaddress
-        # refuses but a socket accepts, such as "0" (INADDR_ANY) and "127.1".
-        infos = socket.getaddrinfo(candidate, None, type=socket.SOCK_STREAM)
-    except (OSError, UnicodeError, ValueError):
-        return ()
-
-    addresses = []
-    for info in infos:
-        # A link-local sockaddr carries a %scope suffix that ipaddress refuses.
-        text = str(info[4][0]).split("%", 1)[0]
-        try:
-            addresses.append(ipaddress.ip_address(text))
-        except ValueError:
-            return ()
-    return tuple(addresses)
-
-
-def _is_loopback_host(host: str) -> bool:
-    """
-    Report whether only this machine could reach a panel bound to a host.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        True only when the spelling is known to resolve to loopback addresses
-        and nothing else. A spelling that cannot be resolved is not loopback,
-        because guessing in the other direction publishes a root shell.
-    """
-    addresses = _host_addresses(host)
-    return bool(addresses) and all(address.is_loopback for address in addresses)
-
-
-def _normalize_host(host: str) -> str:
-    """
-    Canonicalise a host spelling so what is checked is what is reported.
-
-    Args:
-        host: The spelling the operator typed.
-
-    Returns:
-        The canonical spelling. Every way of writing "every interface" becomes
-        the address it binds, so the refusal below names a real address instead
-        of quoting an empty string back at the operator.
-    """
-    candidate = _strip_brackets(host)
-    addresses = _host_addresses(candidate)
-    if not addresses:
-        return candidate
-    if candidate in WILDCARD_SPELLINGS or all(address.is_unspecified for address in addresses):
-        return str(addresses[0])
-    try:
-        return str(ipaddress.ip_address(candidate))
-    except ValueError:
-        # A name: binding it is the resolver's business, not this module's.
-        return candidate
-
 
 @dataclass(frozen=True)
 class StartOptions:
@@ -422,11 +319,11 @@ def _build_security_config(options: StartOptions) -> SecurityConfig:
 
     # Normalised first, so the exposure decision, the message and the address
     # that is finally bound all talk about the same thing.
-    host = _normalize_host(options.host)
+    host = normalize_host(options.host)
     port = options.port
     whitelist = list(options.allow_ip)
     proxies = list(options.trusted_proxy)
-    local_only = _is_loopback_host(host)
+    local_only = is_loopback_host(host)
 
     if options.require_https and not (options.tls_cert and options.tls_key):
         raise SecurityError(
@@ -443,7 +340,7 @@ def _build_security_config(options: StartOptions) -> SecurityConfig:
         unresolved = (
             f"WASM could not resolve {host!r}, so it cannot show that only this machine "
             "would reach the panel, and treats it as exposed.\n"
-            if not _host_addresses(host)
+            if not host_addresses(host)
             else ""
         )
         raise SecurityError(
@@ -723,12 +620,12 @@ def _port_in_use(host: str, port: int) -> bool:
     Returns:
         True when binding would fail because something holds the address.
     """
-    family = socket.AF_INET6 if ":" in _strip_brackets(host) else socket.AF_INET
+    family = socket.AF_INET6 if ":" in strip_brackets(host) else socket.AF_INET
     probe = socket.socket(family, socket.SOCK_STREAM)
     try:
         # Deliberately not SO_REUSEADDR: with it the bind succeeds against a
         # socket in TIME_WAIT, which is the case this is meant to catch.
-        probe.bind((_strip_brackets(host), port))
+        probe.bind((strip_brackets(host), port))
     except OSError:
         return True
     except (ValueError, socket.gaierror):
@@ -740,6 +637,84 @@ def _port_in_use(host: str, port: int) -> bool:
     return False
 
 
+def _first_free_port(host: str, port: int) -> int | None:
+    """
+    Find a port to offer in place of one that is taken.
+
+    Args:
+        host: Address the panel would bind.
+        port: The port that turned out to be taken.
+
+    Returns:
+        The first free port above it, or None when the whole search span is
+        held. Naming a port without checking it is what made the old suggestion
+        useless: it was the requested port plus one, and on a machine busy
+        enough to hit this at all that is frequently taken too.
+    """
+    for candidate in range(port + 1, min(port + 1 + PORT_SUGGESTION_SPAN, 65536)):
+        if not _port_in_use(host, candidate):
+            return candidate
+    return None
+
+
+def _report_taken_port(host: str, port: int, logger: Logger) -> None:
+    """
+    Explain a taken port, including why the panel does not move itself.
+
+    Moving to the next free port would be the obliging thing to do and it is
+    the wrong thing to do. The port is an address other things point at - an
+    SSH tunnel, a reverse proxy, a bookmark, a script - so a panel that lands
+    somewhere new whenever the old place is busy cannot be automated. It would
+    also paper over the case this check exists to catch: a second panel, still
+    running, still holding a root session.
+
+    None of that is obvious from the outside, so it is said rather than
+    implied.
+
+    Args:
+        host: Address the panel would have bound.
+        port: The port something else holds.
+        logger: Logger for the report.
+    """
+    logger.error(f"Something is already listening on {host}:{port}")
+    logger.info("WASM does not move the panel to another port on its own:")
+    logger.info("  the port is what your SSH tunnel, proxy and bookmarks point at,")
+    logger.info("  and moving it would hide a panel that is still running here.")
+    logger.info("If it is a panel this machine has forgotten about:")
+    logger.info("  wasm web stop")
+    logger.info("To see what holds the port:")
+    logger.info(f"  ss -ltnp 'sport = :{port}'")
+
+    free = _first_free_port(host, port)
+    if free is None:
+        logger.info(
+            f"Nothing up to {port + PORT_SUGGESTION_SPAN} is free either. "
+            "Choose a port with --port."
+        )
+        return
+    logger.info(f"Or serve on {free}, which is free right now:")
+    logger.info(f"  wasm web start --port {free}")
+
+
+def _report_daemon_started(config: SecurityConfig, pid: int, logger: Logger) -> None:
+    """
+    Report a backgrounded panel, and how to reach it.
+
+    Args:
+        config: The configuration it was started with.
+        pid: Process id of the panel.
+        logger: Logger for the report.
+    """
+    scheme = "https" if config.require_https else "http"
+
+    logger.success(f"Web server started in background (PID: {pid})")
+    logger.info(f"Server running at {scheme}://{config.host}:{config.port}")
+    for line in loopback_access_lines(config.host, config.port, scheme=scheme):
+        logger.info(line)
+    logger.info("Use 'wasm web status' to check status")
+    logger.info("Use 'wasm web stop' to stop the server")
+
+
 def _start(options: StartOptions, verbose: bool, *, dry_run: bool = False) -> int:
     """
     Start the panel, refusing an unsafe exposure first.
@@ -811,20 +786,14 @@ def _start(options: StartOptions, verbose: bool, *, dry_run: bool = False) -> in
     # bare OSError, leaving an operator holding a credential for a server that
     # never started.
     if not dry_run and _port_in_use(host, config.port):
-        logger.error(f"Something is already listening on {host}:{config.port}")
-        logger.info("If it is a panel this machine has forgotten about:")
-        logger.info("  wasm web stop")
-        logger.info("To see what holds the port:")
-        logger.info(f"  ss -ltnp 'sport = :{config.port}'")
-        logger.info("Or serve somewhere else:")
-        logger.info(f"  wasm web start --port {config.port + 1}")
+        _report_taken_port(host, config.port, logger)
         return 1
 
     if config.ip_whitelist:
         logger.info(f"Only these clients may connect: {', '.join(config.ip_whitelist)}")
     if config.trusted_proxies:
         logger.info(f"Forwarding headers believed from: {', '.join(config.trusted_proxies)}")
-    elif _is_loopback_host(host) and not config.require_https:
+    elif is_loopback_host(host) and not config.require_https:
         logger.warning(
             "Serving plain HTTP on loopback. Behind a TLS proxy, pass --trusted-proxy "
             "so the session cookie is issued with the Secure flag."
@@ -882,17 +851,13 @@ def _start_daemon(config: SecurityConfig, verbose: bool) -> int:
         Exit code.
     """
     logger = Logger(verbose=verbose)
-    scheme = "https" if config.require_https else "http"
 
     # Fork process
     pid = os.fork()
 
     if pid > 0:
         # Parent process
-        logger.success(f"Web server started in background (PID: {pid})")
-        logger.info(f"Server running at {scheme}://{config.host}:{config.port}")
-        logger.info("Use 'wasm web status' to check status")
-        logger.info("Use 'wasm web stop' to stop the server")
+        _report_daemon_started(config, pid, logger)
         return 0
 
     # Child process

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/src/wasm/cli/commands/webapp.py

@@ -47,6 +47,7 @@ from wasm.core.utils import domain_to_app_name, remove_directory
 from wasm.deployers import detect_app_type, get_deployer
 from wasm.deployers.docker_compose import DockerComposeDeployer
 from wasm.deployers.monorepo import MonorepoDeployer
+from wasm.deployers.registry import available_types
 from wasm.managers.apache_manager import ApacheManager
 from wasm.managers.backup_manager import RollbackManager
 from wasm.managers.cert_manager import CertManager
@@ -68,17 +69,10 @@ _FOLLOW_TIMEOUT = 86400
 #: Docker Compose pulls images and rebuilds; it needs room.
 _COMPOSE_TIMEOUT = 1800
 
-#: Application types ``create`` accepts, in the order they are offered.
-APP_TYPES = [
-    "nextjs",
-    "nodejs",
-    "vite",
-    "python",
-    "static",
-    "monorepo",
-    "docker-compose",
-    "auto",
-]
+#: Application types ``create`` accepts, in the order they are offered. Read
+#: from the registry rather than typed out here: a hand-written copy is a copy
+#: that goes stale the first time a deployer is added, and it did.
+APP_TYPES = [entry["type"] for entry in available_types()]
 
 #: Node package managers ``create`` and ``update`` accept.
 PACKAGE_MANAGERS = ["npm", "pnpm", "bun", "auto"]

wasm_cli-1.2.0/src/wasm/core/net.py

@@ -0,0 +1,252 @@
+# Copyright (c) 2024-2026 Yago Lopez Prado
+# Licensed under WASM-NCSAL 1.0 (Commercial use prohibited)
+# https://github.com/Perkybeet/wasm/blob/main/LICENSE
+
+"""
+How a listening address is classified, and how an operator reaches it.
+
+One question is asked of this module twice. The CLI asks whether an address is
+reachable from another machine, because that decides whether it will serve a
+root panel on it at all. The startup banner asks the same thing, because an
+address only this machine can open has to come with instructions for opening it
+from somewhere else. Two callers, one classification: a security decision that
+is made in two places is a security decision that drifts, and this one is
+subtle enough that the second copy would have been the wrong one - "", ``*``,
+``0``, ``0.0.0.0``, ``::`` and a name resolving to any of them are six
+spellings of the same socket.
+
+The instructions matter as much as the classification. A panel started over SSH
+on a server with no desktop printed ``Server: http://127.0.0.1:8080`` and
+stopped there, which is an address that, from the machine the operator is
+actually sitting at, does not exist.
+"""
+
+from __future__ import annotations
+
+import getpass
+import ipaddress
+import os
+import socket
+
+#: The address a socket is given when it should answer on every interface. It
+#: is named here to be recognised and refused, never bound by default.
+ALL_INTERFACES = "0.0.0.0"  # noqa: S104
+
+#: Spellings of "every interface" that no resolver accepts, so they cannot be
+#: classified by looking them up. The empty string is the one that mattered: a
+#: version of this check kept a set of loopback *strings* with "" in it, and
+#: ``wasm web start --host ""`` walked past the refusal and bound the root
+#: panel to every interface in cleartext.
+WILDCARD_SPELLINGS = frozenset({"", "*"})
+
+#: Shown in place of a login name when the passwd database has no entry for
+#: this uid, which happens in containers. The command stays copy-editable.
+UNKNOWN_USER = "user"
+
+#: Address family alias, for the helpers below.
+IPAddress = ipaddress.IPv4Address | ipaddress.IPv6Address
+
+
+def strip_brackets(host: str) -> str:
+    """
+    Remove the brackets an IPv6 literal is often written with.
+
+    Args:
+        host: The spelling the operator typed.
+
+    Returns:
+        The spelling without a surrounding ``[]`` pair.
+    """
+    candidate = host.strip()
+    if len(candidate) > 1 and candidate.startswith("[") and candidate.endswith("]"):
+        return candidate[1:-1]
+    return candidate
+
+
+def host_addresses(host: str) -> tuple[IPAddress, ...]:
+    """
+    Return every address a host spelling would end up bound to.
+
+    Comparing host strings is what made this decision wrong: "", ``*``, ``0``,
+    ``0.0.0.0``, ``::`` and a name in ``/etc/hosts`` pointing at 0.0.0.0 are six
+    spellings of the same socket, and a set of known-good strings misses five of
+    them. The resolver is asked instead, and its answer is classified with
+    :mod:`ipaddress`.
+
+    Args:
+        host: The spelling the operator typed.
+
+    Returns:
+        The addresses, empty when the spelling cannot be resolved. Empty means
+        "unknown", and every caller treats unknown as exposed.
+    """
+    candidate = strip_brackets(host)
+    if candidate in WILDCARD_SPELLINGS:
+        return (ipaddress.ip_address(ALL_INTERFACES),)
+
+    try:
+        return (ipaddress.ip_address(candidate),)
+    except ValueError:
+        pass
+
+    try:
+        # A resolution covers names and also the inet_aton spellings ipaddress
+        # refuses but a socket accepts, such as "0" (INADDR_ANY) and "127.1".
+        infos = socket.getaddrinfo(candidate, None, type=socket.SOCK_STREAM)
+    except (OSError, UnicodeError, ValueError):
+        return ()
+
+    addresses = []
+    for info in infos:
+        # A link-local sockaddr carries a %scope suffix that ipaddress refuses.
+        text = str(info[4][0]).split("%", 1)[0]
+        try:
+            addresses.append(ipaddress.ip_address(text))
+        except ValueError:
+            return ()
+    return tuple(addresses)
+
+
+def is_loopback_host(host: str) -> bool:
+    """
+    Report whether only this machine could reach a service bound to a host.
+
+    Args:
+        host: The spelling the operator typed.
+
+    Returns:
+        True only when the spelling is known to resolve to loopback addresses
+        and nothing else. A spelling that cannot be resolved is not loopback,
+        because guessing in the other direction publishes a root shell.
+    """
+    addresses = host_addresses(host)
+    return bool(addresses) and all(address.is_loopback for address in addresses)
+
+
+def normalize_host(host: str) -> str:
+    """
+    Canonicalise a host spelling so what is checked is what is reported.
+
+    Args:
+        host: The spelling the operator typed.
+
+    Returns:
+        The canonical spelling. Every way of writing "every interface" becomes
+        the address it binds, so a refusal names a real address instead of
+        quoting an empty string back at the operator.
+    """
+    candidate = strip_brackets(host)
+    addresses = host_addresses(candidate)
+    if not addresses:
+        return candidate
+    if candidate in WILDCARD_SPELLINGS or all(address.is_unspecified for address in addresses):
+        return str(addresses[0])
+    try:
+        return str(ipaddress.ip_address(candidate))
+    except ValueError:
+        # A name: binding it is the resolver's business, not this module's.
+        return candidate
+
+
+def local_address() -> str:
+    """
+    Best-effort address of this machine, for a banner.
+
+    Returns:
+        The outbound interface address, or 127.0.0.1 when it cannot be found.
+    """
+    try:
+        with socket.socket(socket.AF_INET, socket.SOCK_DGRAM) as sock:
+            # A UDP connect sends nothing; it only asks the routing table which
+            # source address a packet to that destination would leave from.
+            sock.connect(("8.8.8.8", 80))
+            return str(sock.getsockname()[0])
+    except OSError:
+        return "127.0.0.1"
+
+
+def server_address() -> str:
+    """
+    Name this server the way the operator's own machine would reach it.
+
+    ``SSH_CONNECTION`` is preferred over the outbound interface because it holds
+    the address this very session arrived on. Behind NAT, on a host with several
+    interfaces, or on a VPS with a separate private network, that is the address
+    that works and the outbound one is a guess.
+
+    Returns:
+        An address or a placeholder; never raises, because a banner is not worth
+        an exception.
+    """
+    parts = os.environ.get("SSH_CONNECTION", "").split()
+    if len(parts) >= 4:
+        return parts[2]
+    return local_address()
+
+
+def _current_user() -> str:
+    """
+    Return the login name to put in an SSH command.
+
+    Returns:
+        The current user, or a placeholder when there is no passwd entry.
+    """
+    try:
+        return getpass.getuser()
+    except (KeyError, OSError):
+        return UNKNOWN_USER
+
+
+def ssh_target() -> str:
+    """
+    Build the ``user@host`` an operator would SSH to.
+
+    Returns:
+        The target, ready to paste into an ssh command line.
+    """
+    return f"{_current_user()}@{server_address()}"
+
+
+def loopback_access_lines(host: str, port: int, scheme: str = "http") -> tuple[str, ...]:
+    """
+    Explain how to open a service that only answers on this machine.
+
+    Args:
+        host: The address the service is bound to.
+        port: The port it listens on.
+        scheme: ``http`` or ``https``, matching what it serves.
+
+    Returns:
+        Lines for a banner, empty when the address is reachable from another
+        machine and needs no forwarding. Callers print them as they are.
+    """
+    if not is_loopback_host(host):
+        return ()
+
+    literal = normalize_host(host)
+    # ssh -L splits its argument on colons, so an IPv6 literal has to be
+    # bracketed or the address is read as a port and a host.
+    forwarded = f"[{literal}]" if ":" in literal else literal
+
+    return (
+        "This address answers on the server itself and nowhere else.",
+        "To open it from your own machine, forward the port over SSH:",
+        f"  ssh -L {port}:{forwarded}:{port} {ssh_target()}",
+        f"then browse to {scheme}://localhost:{port} there.",
+    )
+
+
+__all__ = [
+    "ALL_INTERFACES",
+    "UNKNOWN_USER",
+    "WILDCARD_SPELLINGS",
+    "IPAddress",
+    "host_addresses",
+    "is_loopback_host",
+    "local_address",
+    "loopback_access_lines",
+    "normalize_host",
+    "server_address",
+    "ssh_target",
+    "strip_brackets",
+]

{wasm_cli-1.1.0 → wasm_cli-1.2.0}/src/wasm/deployers/registry.py

@@ -159,6 +159,30 @@ def detect_app_type(path: Path, verbose: bool = False) -> str | None:
     return DeployerRegistry.detect(path, verbose=verbose)
 
 
+def available_types() -> list[dict[str, str]]:
+    """
+    List the application types anything in the product may offer.
+
+    The registry is the only place that knows what can be deployed, so it is
+    the only place that should answer this. The CLI used to carry a
+    hand-written list of eight strings and the panel had no list at all, which
+    is how a deployer could be added and reach neither front door.
+
+    Returns:
+        One mapping per type, with ``type`` and ``name``, ordered with the
+        detectors first and ``auto`` last: picking a specific type is the
+        deliberate choice, and offering "let WASM decide" at the top invites
+        the operator to skip a decision they usually know the answer to.
+    """
+    _import_deployers()
+
+    types = [
+        {"type": str(entry["type"]), "name": str(entry["name"])}
+        for entry in DeployerRegistry.list_deployers()
+    ]
+    return sorted(types, key=lambda entry: (entry["type"] == "auto", entry["name"].lower()))
+
+
 def _import_deployers() -> None:
     """
     Import every deployer module so that registration has happened.