1	import Base
2	import bend-kit-files@0.1.0.0/files.bend as Fs
3	import bend-net-json@0.3.0.0/json.bend as Json
4	import ./effs/io.bend as X
5	import ../type.bend as A
6	import ../ops.bend as O
7	import ./container/effects.bend as CtE
8	import ./deployment/type.bend as D
9	import ./deployment/ops.bend as DO
10	import ./deployment/azure/effects.bend as AzE
11	import ./deployment/launchd/effects.bend as LdE
12	import ./deployment/nix_darwin/type.bend as ND
13	import ./deployment/nix_darwin/ops.bend as NDO
14	import ./deployment/nix_darwin/effects.bend as NDE
15	import ./deployment/nix_darwin/setting/type.bend as St
16	import ./deployment/nix_darwin/setting/ops.bend as StO
17	import ./deployment/nix_darwin/brew/type.bend as Br
18	import ./deployment/nix_darwin/setting/effects.bend as StE
19	import ./deployment/nix_darwin/brew/effects.bend as BrE
20	import ./deployment/nix_darwin/service/ops.bend as SvO
21	import ./release/type.bend as Rl
22	import ./release/ops.bend as RlO
23	import ./release/plugin/ops.bend as PlO
24	import ./plan/type.bend as P
25	import ./plan/ops.bend as PO
26	import ./ops.bend as SO
27	
28	# The system's effects: reading the repository, the Bend hub and GitHub (a snapshot of the world), and
29	# changing them (a deploy). Programs run with their arguments, never through a shell; files are read with
30	# Base's File API.
31	
32	# ---- the repository's files ----
33	def files(+root: String) -> IO(List<&2, String>):
34	  do IO<List<&2, String>>:
35	    out : String <- X.run("git", ["-C", root, "ls-files", "-co", "--exclude-standard"])
36	    return X.nonempty(String.lines(out))
37	
38	# ---- what an entry reaches: it and every file it imports, followed in Bend ----
39	def second_word(+t: String) -> String:
40	  Maybe.default(&2, String, List.get(&2, String, X.nonempty(String.split(t, ' ')), 1n), "")
41	
42	def unquote(+w: String) -> String:
43	  Bool.pick(String, String.starts_with(w, "\""), Maybe.default(&2, String, List.get(&2, String, String.split(w, '"'), 1n), ""), w)
44	
45	# The file a line imports, relative to the repository, or "" when it imports none of the repository's.
46	def import_of(+line: String, +dir: String) -> String:
47	  +w = unquote(second_word(String.trim(line)))
48	  Bool.pick(String, String.starts_with(String.trim(line), "import ") && (String.starts_with(w, "./") || String.starts_with(w, "../")),
49	    Fs.path.normalize(Fs.path.join(dir, w)), "")
50	
51	def imports(ls: List<&2, String>, +dir: String) -> List<&2, String>:
52	  match ls:
53	    case []:
54	      []
55	    case l <> rest:
56	      X.nonempty(import_of(l, dir) <> imports(rest, dir))
57	
58	# Each step reads one file; the number of files squared bounds the walk.
59	def reach(fuel: Nat, +todo: List<&2, String>, +seen: List<&2, String>, +root: String) -> IO(List<&2, String>):
60	  match fuel:
61	    case 0n:
62	      IO.pure(List<&2, String>, seen)
63	    case 1n+k:
64	      match todo:
65	        case []:
66	          IO.pure(List<&2, String>, seen)
67	        case +f <> rest:
68	          do IO<List<&2, String>>:
69	            text : String <- X.read_head(root ++ "/" ++ f, 4096)
70	            +known : Bool = List.contains(~String, ~String.eq, seen, f)
71	            reach(k, List.append(&2, String, rest, Bool.pick(List<&2, String>, known, [], imports(String.lines(text), Fs.path.parent(f)))), Bool.pick(List<&2, String>, known, seen, f <> seen), root)
72	
73	# ---- the Bend hub: has it published this package, with these exact files? ----
74	def differing(fs: List<&2, String>, +local: String, +hub: String) -> IO(String):
75	  match fs:
76	    case []:
77	      IO.pure(String, "")
78	    case +f <> rest:
79	      do IO<String>:
80	        same : Bool <- X.succeeds("cmp", ["-s", local ++ "/" ++ f, hub ++ "/" ++ f])
81	        more : String <- differing(rest, local, hub)
82	        return Bool.pick(String, same, more, f)
83	
84	def hub_of(+published: String, +f: String) -> P.Hub:
85	  Bool.pick(P.Hub, String.is_empty(published), P.Unpublished{}, Bool.pick(P.Hub, String.is_empty(f), P.Same{}, P.Differs{f}))
86	
87	# The package's hash, as Bend's local cache names it. A package not cached yet is fetched first by
88	# checking a file that imports it: the hub has it exactly when that succeeds.
89	def fetch_if(missing: Bool, +home: String, +n: String, +v: String, +e: String, +cached: String) -> IO(String):
90	  match missing:
91	    case False{}:
92	      IO.pure(String, cached)
93	    case True{}:
94	      do IO<String>:
95	        X.write("/tmp/v-probe.bend", "import Base\nimport " ++ n ++ "@" ++ v ++ "/" ++ Fs.path.file_name(e) ++ " as P\n")
96	        _ : Bool <- X.succeeds(home ++ "/.bend/bin/bend", ["/tmp/v-probe.bend", "--check-only"])
97	        X.read(home ++ "/.bend/lib/names/" ++ n ++ "@" ++ v)
98	
99	def fetched(+home: String, +n: String, +v: String, +e: String, +cached: String) -> IO(String):
100	  fetch_if(String.is_empty(String.trim(cached)), home, n, v, e, cached)
101	
102	def hub_state(+home: String, +root: String, p: Rl.Package) -> IO(P.Hub):
103	  match p:
104	    case Rl.Package{+n, +v, +e, _}:
105	      do IO<P.Hub>:
106	        cached : String <- X.read(home ++ "/.bend/lib/names/" ++ n ++ "@" ++ v)
107	        +hash : String <- fetched(home, n, v, e, cached)
108	        +files : List<&2, String> <- reach(1000n, [e], [], root)
109	        f : String <- differing(files, root, home ++ "/.bend/lib/" ++ String.trim(hash))
110	        return hub_of(String.trim(hash), f)
111	
112	def hub_states(+home: String, +root: String, ps: List<&2, Rl.Package>) -> IO(List<&2, P.Hub>):
113	  match ps:
114	    case []:
115	      IO.pure(List<&2, P.Hub>, [])
116	    case p <> rest:
117	      do IO<List<&2, P.Hub>>:
118	        h : P.Hub <- hub_state(home, root, p)
119	        hs : List<&2, P.Hub> <- hub_states(home, root, rest)
120	        return h <> hs
121	
122	# ---- GitHub ----
123	def first_word(+t: String) -> String:
124	  Maybe.default(&2, String, List.head(&2, String, X.nonempty(String.split(t, '\t'))), "")
125	
126	def pushed(+root: String, +sha: String) -> IO(Bool):
127	  Bool.pick(IO(Bool), String.is_empty(sha), IO.pure(Bool, False{}), X.succeeds("git", ["-C", root, "merge-base", "--is-ancestor", "HEAD", sha]))
128	
129	def remote(+root: String, r: Rl.Repository) -> IO(P.Remote):
130	  match r:
131	    case Rl.Repository{+name, _}:
132	      do IO<P.Remote>:
133	        origin : String <- X.run("git", ["-C", root, "remote", "get-url", "origin"])
134	        vis : String <- X.run("gh", ["repo", "view", name, "--json", "visibility", "--jq", ".visibility"])
135	        status : String <- X.run("git", ["-C", root, "status", "--porcelain"])
136	        head : String <- X.run("git", ["-C", root, "ls-remote", "origin", "refs/heads/main"])
137	        up : Bool <- pushed(root, first_word(head))
138	        return P.Remote{String.trim(origin), String.to_lower(String.trim(vis)), String.is_empty(String.trim(status)), up}
139	
140	# ---- a plugin: a fresh build of it, next to what its marketplace has tagged for its version ----
141	# Built under .git/v-plugin/<name>, never committed: build/ is what a release would hold at
142	# plugins/<name>, tag/ is the marketplace at the tag, repo/ the marketplace a release writes.
143	def plugin_dir(+root: String, +n: String) -> String:
144	  root ++ "/.git/v-plugin/" ++ n
145	
146	def tag_of(+n: String, +v: String) -> String:
147	  n ++ "-v" ++ v
148	
149	def last_segment(xs: List<&2, String>) -> String:
150	  Maybe.default(&2, String, List.last(&2, String, xs), "")
151	
152	def owner_of(+r: String) -> String:
153	  Maybe.default(&2, String, List.head(&2, String, String.split(r, '/')), "")
154	
155	def str_of(m: Maybe<&2, Json.Val>) -> String:
156	  match m:
157	    case Some{Json.Str{s}}:
158	      s
159	    case _:
160	      ""
161	
162	def version_in(m: Maybe<&2, Json.Val>) -> String:
163	  match m:
164	    case Some{v}:
165	      str_of(Json.get(v, "version"))
166	    case None{}:
167	      ""
168	
169	def obj.go(kvs: List<&2, Sigma<&2, &2, String, _ => Json.Val>>, m: Map<&2, Json.Val>) -> Map<&2, Json.Val>:
170	  match kvs:
171	    case []:
172	      m
173	    case (k, v) <> rest:
174	      obj.go(rest, Map.set(&2, Json.Val, m, k, v))
175	
176	def obj(kvs: List<&2, Sigma<&2, &2, String, _ => Json.Val>>) -> Json.Val:
177	  Json.Obj{obj.go(kvs, Map.new(&2, Json.Val))}
178	
179	# The marketplace's other plugins, as listed now.
180	def others(vs: List<&2, Json.Val>, +n: String) -> List<&2, Json.Val>:
181	  match vs:
182	    case []:
183	      []
184	    case +v <> rest:
185	      +kept = others(rest, n)
186	      Bool.pick(List<&2, Json.Val>, String.eq(str_of(Json.get(v, "name")), n), kept, v <> kept)
187	
188	def listed(m: Maybe<&2, Json.Val>) -> List<&2, Json.Val>:
189	  match m:
190	    case Some{Json.Arr{vs}}:
191	      vs
192	    case _:
193	      []
194	
195	# The marketplace's listing with this plugin at this version, every other plugin as it was.
196	def marketplace(+now: String, +n: String, +v: String, +r: String) -> String:
197	  +m = Json.parse(now)
198	  Json.encode(obj([
199	    ("name", Json.Str{last_segment(String.split(r, '/'))}),
200	    ("owner", obj([("name", Json.Str{owner_of(r)})])),
201	    ("plugins", Json.Arr{List.append(&2, Json.Val, others(listed(Bool.pick(Maybe<&2, Json.Val>, Maybe.is_some(&2, Json.Val, m), Json.get(Maybe.default(&2, Json.Val, m, Json.Null{}), "plugins"), None{})), n),
202	      [obj([("name", Json.Str{n}), ("source", Json.Str{"./plugins/" ++ n}), ("version", Json.Str{v})])])})])) ++ "\n"
203	
204	def build_plugin(+root: String, +bend: String, +n: String, +e: String) -> IO(String):
205	  do IO<String>:
206	    +build : String = plugin_dir(root, n) ++ "/build"
207	    _ : Bool <- X.succeeds("rm", ["-rf", plugin_dir(root, n)])
208	    _ : Bool <- X.succeeds("mkdir", ["-p", build])
209	    ok : Bool <- X.succeeds(bend, [root ++ "/" ++ e, "plugin", build])
210	    manifest : String <- X.read(build ++ "/.claude-plugin/plugin.json")
211	    return Bool.pick(String, ok, version_in(Json.parse(manifest)), "")
212	
213	def tag_differs(tagged: Bool, +root: String, +n: String, +v: String, +r: String) -> IO(Bool):
214	  match tagged:
215	    case False{}:
216	      IO.pure(Bool, False{})
217	    case True{}:
218	      do IO<Bool>:
219	        _ : Bool <- X.succeeds("git", ["clone", "-q", "--depth", "1", "--branch", tag_of(n, v), "https://github.com/" ++ r, plugin_dir(root, n) ++ "/tag"])
220	        same : Bool <- X.succeeds("diff", ["-rq", plugin_dir(root, n) ++ "/build", plugin_dir(root, n) ++ "/tag/plugins/" ++ n])
221	        return Bool.not(same)
222	
223	def tag_state(+home: String, +root: String, g: Rl.Plugin) -> IO(P.Tag):
224	  match g:
225	    case Rl.Plugin{+n, ver, +e, _, Rl.Repository{+r, _}}:
226	      do IO<P.Tag>:
227	        +v : String = PlO.version_show(ver)
228	        built : String <- build_plugin(root, home ++ "/.bend/bin/bend", n, e)
229	        valid : Bool <- X.succeeds("claude", ["plugin", "validate", "--strict", plugin_dir(root, n) ++ "/build"])
230	        +repo : Bool <- X.succeeds("gh", ["repo", "view", r, "--json", "name"])
231	        tags : String <- X.run("git", ["ls-remote", "--tags", "https://github.com/" ++ r, "refs/tags/" ++ tag_of(n, v)])
232	        +tagged : Bool = repo && Bool.not(String.is_empty(String.trim(tags)))
233	        differs : Bool <- tag_differs(tagged, root, n, v, r)
234	        return P.Tag{repo, tagged, built, valid, differs}
235	
236	def tag_states(+home: String, +root: String, gs: List<&2, Rl.Plugin>) -> IO(List<&2, P.Tag>):
237	  match gs:
238	    case []:
239	      IO.pure(List<&2, P.Tag>, [])
240	    case g <> rest:
241	      do IO<List<&2, P.Tag>>:
242	        t : P.Tag <- tag_state(home, root, g)
243	        ts : List<&2, P.Tag> <- tag_states(home, root, rest)
244	        return t <> ts
245	
246	# Codex's listing of the same marketplace (.agents/plugins/marketplace.json), with this plugin available and
247	# every other plugin as it was.
248	def codex_marketplace(+now: String, +n: String, +r: String) -> String:
249	  +m = Json.parse(now)
250	  Json.encode(obj([
251	    ("name", Json.Str{last_segment(String.split(r, '/'))}),
252	    ("interface", obj([("displayName", Json.Str{last_segment(String.split(r, '/'))})])),
253	    ("plugins", Json.Arr{List.append(&2, Json.Val, others(listed(Bool.pick(Maybe<&2, Json.Val>, Maybe.is_some(&2, Json.Val, m), Json.get(Maybe.default(&2, Json.Val, m, Json.Null{}), "plugins"), None{})), n),
254	      [obj([("name", Json.Str{n}), ("source", obj([("source", Json.Str{"local"}), ("path", Json.Str{"./plugins/" ++ n})])),
255	        ("policy", obj([("installation", Json.Str{"AVAILABLE"}), ("authentication", Json.Str{"ON_USE"})])),
256	        ("category", Json.Str{"Productivity"})])])})])) ++ "\n"
257	
258	# A release: the build into plugins/<name>, both listings updated, committed, tagged and pushed.
259	def release_plugin(+root: String, +n: String, +v: String, +r: String, create: Bool) -> IO(Bool):
260	  do IO<Bool>:
261	    +repo : String = plugin_dir(root, n) ++ "/repo"
262	    _ : Bool <- Bool.pick(IO(Bool), create, X.succeeds("gh", ["repo", "create", r, "--public", "--description", "Claude Code plugins, built and released by V."]), IO.pure(Bool, True{}))
263	    _ : Bool <- X.succeeds("rm", ["-rf", repo])
264	    _ : Bool <- X.succeeds("git", ["clone", "-q", "https://github.com/" ++ r, repo])
265	    _ : Bool <- X.succeeds("mkdir", ["-p", repo ++ "/plugins/" ++ n, repo ++ "/.claude-plugin", repo ++ "/.agents/plugins"])
266	    _ : Bool <- X.succeeds("rsync", ["-a", "--delete", plugin_dir(root, n) ++ "/build/", repo ++ "/plugins/" ++ n ++ "/"])
267	    now : String <- X.read(repo ++ "/.claude-plugin/marketplace.json")
268	    X.write(repo ++ "/.claude-plugin/marketplace.json", marketplace(now, n, v, r))
269	    codex_now : String <- X.read(repo ++ "/.agents/plugins/marketplace.json")
270	    X.write(repo ++ "/.agents/plugins/marketplace.json", codex_marketplace(codex_now, n, r))
271	    _ : Bool <- X.succeeds("git", ["-C", repo, "add", "-A"])
272	    _ : Bool <- X.succeeds("git", ["-C", repo, "commit", "-q", "-m", n ++ " " ++ v])
273	    _ : Bool <- X.succeeds("git", ["-C", repo, "tag", tag_of(n, v)])
274	    X.succeeds("git", ["-C", repo, "push", "-q", "origin", "HEAD:main", tag_of(n, v)])
275	
276	# ---- a snapshot: everything a plan needs ----
277	def root() -> IO(String):
278	  do IO<String>:
279	    t : String <- X.run("git", ["rev-parse", "--show-toplevel"])
280	    return String.trim(t)
281	
282	# The files, what the packages' entries and the system's own entry reach, the hub, and GitHub.
283	def observe(+root: String, +entry: String, r: Rl.Release) -> IO(P.Observed):
284	  match r:
285	    case Rl.Release{repo, +ps, +gs}:
286	      do IO<P.Observed>:
287	        +h : String <- X.home()
288	        +fs : List<&2, String> <- files(root)
289	        reached : List<&2, String> <- reach(Nat.mul(1n+List.length(&2, String, fs), 1n+List.length(&2, String, fs)), entry <> List.append(&2, String, RlO.entries(ps), RlO.plugin_entries(gs)), [], root)
290	        hs : List<&2, P.Hub> <- hub_states(h, root, ps)
291	        rm : P.Remote <- remote(root, repo)
292	        ts : List<&2, P.Tag> <- tag_states(h, root, gs)
293	        return P.Observed{fs, reached, hs, rm, ts}
294	
295	# ---- a deploy: carry out a plan with nothing blocked ----
296	def apply(+root: String, +bend: String, s: P.Step) -> IO(Unit):
297	  match s:
298	    case P.Current{_}:
299	      IO.print(PO.show(s))
300	    case P.Publish{+n, +v, +e}:
301	      do IO<Unit>:
302	        out : String <- X.run(bend, [root ++ "/" ++ e, "--publish", n ++ "@" ++ v])
303	        IO.print(Bool.pick(String, String.contains(out, "published"), "published " ++ n ++ "@" ++ v, "failed   publish " ++ n ++ "@" ++ v))
304	    case P.Push{+r}:
305	      do IO<Unit>:
306	        ok : Bool <- X.succeeds("git", ["-C", root, "push", "-q", "origin", "HEAD:main"])
307	        IO.print(Bool.pick(String, ok, "pushed   github " ++ r, "failed   push github " ++ r))
308	    case P.ReleasePlugin{+n, +v, +r, create}:
309	      do IO<Unit>:
310	        ok : Bool <- release_plugin(root, n, v, r, create)
311	        IO.print(Bool.pick(String, ok, "released plugin " ++ n ++ "@" ++ v, "failed   release plugin " ++ n ++ "@" ++ v))
312	    case P.Install{+from, +to}:
313	      do IO<Unit>:
314	        _ : Bool <- X.succeeds("/bin/mkdir", ["-p", Fs.path.parent(to)])
315	        ok : Bool <- X.succeeds("/bin/cp", [from, to])
316	        IO.print(Bool.pick(String, ok, "installed " ++ to, "failed   install " ++ to))
317	    case P.Launch{+l, +path, +plist, +domain}:
318	      do IO<Unit>:
319	        _ : Bool <- X.succeeds("/bin/mkdir", ["-p", Fs.path.parent(path)])
320	        X.write(path, plist)
321	        _ : Bool <- X.succeeds("/bin/launchctl", ["bootout", domain ++ "/" ++ l])
322	        ok : Bool <- X.succeeds("/bin/launchctl", ["bootstrap", domain, path])
323	        IO.print(Bool.pick(String, ok, "launched " ++ l, "failed   launch " ++ l))
324	    case P.Rebuild{+h, +fl, +mac}:
325	      do IO<Unit>:
326	        _ : Result<&1, &1, U32 & String, Unit> <- Fs.mkdir(root ++ "/nix")
327	        X.write(root ++ "/nix/flake.nix", fl)
328	        X.write(root ++ "/nix/mac.nix", mac)
329	        ok : Bool <- X.succeeds("sudo", ["-n", "/run/current-system/sw/bin/darwin-rebuild", "switch", "--flake", root ++ "/nix#" ++ h])
330	        IO.print(Bool.pick(String, ok, "rebuilt  nix-darwin " ++ h, "failed   darwin-rebuild switch " ++ h))
331	    case P.ServePort{+p, +t, ts}:
332	      do IO<Unit>:
333	        ok : Bool <- X.succeeds(ts, ["serve", "--bg", "--yes", "--https=" ++ U32.show(p), t])
334	        IO.print(Bool.pick(String, ok, "served   :" ++ U32.show(p) ++ " -> " ++ t, "failed   serve :" ++ U32.show(p)))
335	    case P.Change{_, _, _}:
336	      IO.pure(Unit, Unit{})
337	    case P.Blocked{_, _}:
338	      IO.print(PO.show(s))
339	
340	def apply_all(+root: String, +bend: String, ss: List<&2, P.Step>) -> IO(Unit):
341	  match ss:
342	    case []:
343	      IO.pure(Unit, Unit{})
344	    case s <> rest:
345	      do IO<Unit>:
346	        apply(root, bend, s)
347	        apply_all(root, bend, rest)
348	
349	def deploy_if(blocked: Bool, +root: String, +ss: List<&2, P.Step>) -> IO(Unit):
350	  match blocked:
351	    case True{}:
352	      IO.die(Unit, 1, PO.show_all(ss) ++ "nothing deployed: the plan is blocked")
353	    case False{}:
354	      do IO<Unit>:
355	        +h : String <- X.home()
356	        apply_all(root, h ++ "/.bend/bin/bend", ss)
357	
358	def deploy(+root: String, +ss: List<&2, P.Step>) -> IO(Unit):
359	  deploy_if(PO.any_blocked(ss), root, ss)
360	
361	# ---- the whole plan: the release, the stack, each deployment node, and what the deploy would break ----
362	# ---- a nix-darwin node: its checks, what a rebuild would change, and the rebuild when anything would ----
363	def has_change(ss: List<&2, P.Step>) -> Bool:
364	  match ss:
365	    case []:
366	      False{}
367	    case s <> rest:
368	      match s:
369	        case P.Change{_, _, _}:
370	          True{}
371	        case _:
372	          has_change(rest)
373	
374	def mac_of(nd: ND.NixDarwin) -> String:
375	  match nd:
376	    case ND.NixDarwin{_, _, _, _, _, st, fw, br, _, _, _, _, _, _}:
377	      StO.mac_nix(st, fw, br)
378	
379	def host_of(nd: ND.NixDarwin) -> String:
380	  match nd:
381	    case ND.NixDarwin{h, _, _, _, _, _, _, _, _, _, _, _, _, _}:
382	      h
383	
384	def rebuild_if(c: Bool, +h: String, +fl: String, +mac: String) -> List<&2, P.Step>:
385	  match c:
386	    case True{}:
387	      [P.Rebuild{h, fl, mac}]
388	    case False{}:
389	      [P.Current{"nix-darwin " ++ h}]
390	
391	# Whether a generated file differs from the one in the repository (compared by cmp, not in memory).
392	def differs(+path: String, +text: String) -> IO(Bool):
393	  do IO<Bool>:
394	    X.write("/tmp/v-generated", text)
395	    same : Bool <- X.succeeds("cmp", ["-s", "/tmp/v-generated", path])
396	    return Bool.not(same)
397	
398	def darwin_steps(+root: String, +k: String, +nd: ND.NixDarwin) -> IO(List<&2, P.Step>):
399	  match nd:
400	    case ND.NixDarwin{_, _, _, _, _, +st, +fw, +br, _, _, _, _, _, _}:
401	      do IO<List<&2, P.Step>>:
402	        checks : List<&2, P.Step> <- NDE.checks(k, nd)
403	        +settings : List<&2, P.Step> <- StE.changes(st, fw)
404	        +brews : List<&2, P.Step> <- BrE.changes(br)
405	        flake_new : Bool <- differs(root ++ "/nix/flake.nix", NDO.flake(nd))
406	        mac_new : Bool <- differs(root ++ "/nix/mac.nix", mac_of(nd))
407	        return List.append(&2, P.Step, checks, List.append(&2, P.Step, settings, List.append(&2, P.Step, brews,
408	          rebuild_if(flake_new || mac_new || has_change(settings) || has_change(brews), host_of(nd), NDO.flake(nd), mac_of(nd)))))
409	
410	def platform_steps(p: D.Platform, +root: String, +k: String, +a: A.Architecture) -> IO(List<&2, P.Step>):
411	  match p:
412	    case D.Unmanaged{}:
413	      IO.pure(List<&2, P.Step>, [])
414	    case D.Darwin{+nd}:
415	      darwin_steps(root, k, nd)
416	    case D.AzureCloud{az}:
417	      AzE.checks(az, O.agreement(a))
418	    case D.Launchd{ld}:
419	      LdE.checks(root, k, ld)
420	
421	def node_steps(ns: List<&2, D.Node>, +root: String, +a: A.Architecture) -> IO(List<&2, P.Step>):
422	  match ns:
423	    case []:
424	      IO.pure(List<&2, P.Step>, [])
425	    case n <> rest:
426	      match n:
427	        case D.Node{+k, _, _, _, _, pf, kids, _}:
428	          do IO<List<&2, P.Step>>:
429	            here : List<&2, P.Step> <- platform_steps(pf, root, k, a)
430	            below : List<&2, P.Step> <- node_steps(kids, root, a)
431	            after : List<&2, P.Step> <- node_steps(rest, root, a)
432	            return List.append(&2, P.Step, here, List.append(&2, P.Step, below, after))
433	
434	def deployed_path(+root: String) -> String:
435	  root ++ "/.git/v-deployed"
436	
437	def breaks_step(+bs: List<&2, D.Break>, +d: D.Deployment) -> List<&2, P.Step>:
438	  Bool.pick(List<&2, P.Step>, DO.breaks_eq(bs, DO.accepted(d)), [],
439	    [P.Blocked{"deployment", DO.show_breaks(bs) ++ " (declare it as accepted to deploy)"}])
440	
441	# What the deploy would break, against what this repository last deployed (recorded in .git, never committed).
442	def deployed_steps(+root: String, +d: D.Deployment) -> IO(List<&2, P.Step>):
443	  do IO<List<&2, P.Step>>:
444	    +text : String <- X.read(deployed_path(root))
445	    return breaks_step(DO.breaks(DO.recorded_address(text), DO.recorded_stores(text), d), d)
446	
447	def plan_all(+root: String, +entry: String, +a: A.Architecture) -> IO(List<&2, P.Step>):
448	  do IO<List<&2, P.Step>>:
449	    o : P.Observed <- observe(root, entry, SO.release(O.system(a)))
450	    stack : List<&2, P.Step> <- CtE.checks(root, O.containers(a), O.externals(a))
451	    nodes : List<&2, P.Step> <- node_steps(O.nodes(a), root, a)
452	    breaks : List<&2, P.Step> <- deployed_steps(root, O.deployment(a))
453	    return List.append(&2, P.Step, stack, List.append(&2, P.Step, nodes, List.append(&2, P.Step, breaks, PO.plan(SO.release(O.system(a)), o))))
454	
455	# A deploy of the whole plan; afterwards it records the deployment, so the next plan compares against it.
456	def deploy_all(+root: String, +entry: String, +a: A.Architecture) -> IO(Unit):
457	  do IO<Unit>:
458	    +steps : List<&2, P.Step> <- plan_all(root, entry, a)
459	    deploy(root, steps)
460	    X.write(deployed_path(root), DO.record(O.deployment(a)))
461	
462	# ---- import: each nix-darwin node's Mac as it is now, as Bend to declare it with ----
463	def import_node(p: D.Platform, +root: String) -> IO(Unit):
464	  match p:
465	    case D.Darwin{nd}:
466	      match nd:
467	        case ND.NixDarwin{h, _, _, _, _, _, _, _, svs, _, _, _, _, _}:
468	          do IO<Unit>:
469	            st : List<&2, St.Setting> <- StE.observed(root ++ "/nix/options.tsv", SvO.labels(svs))
470	            fw : St.Firewall <- StE.firewall_now()
471	            br : List<&2, Br.Brew> <- BrE.observed()
472	            IO.print("# " ++ h ++ "\n" ++ StO.import_text(st, fw, br))
473	    case _:
474	      IO.pure(Unit, Unit{})
475	
476	def import_nodes(ns: List<&2, D.Node>, +root: String) -> IO(Unit):
477	  match ns:
478	    case []:
479	      IO.pure(Unit, Unit{})
480	    case n <> rest:
481	      match n:
482	        case D.Node{_, _, _, _, _, pf, kids, _}:
483	          do IO<Unit>:
484	            import_node(pf, root)
485	            import_nodes(kids, root)
486	            import_nodes(rest, root)
487	
488	def import_all(+root: String, a: A.Architecture) -> IO(Unit):
489	  import_nodes(O.nodes(a), root)