zap ↯

Convergent machine-state management. Describe what a machine should be in a TypeScript config; zap detects the current state, plans the diff, applies idempotent changes, and emits structured events.

A pure-Rust CLI, version 0.1.0 — in active development.

the loop

One model across every domain — installing tools, provisioning machines, deploying services, detecting drift.

  1. describe — declare desired state in a TypeScript config
  2. detect — inspect what the machine actually looks like now
  3. plan — diff desired against actual — the dry run
  4. apply — converge the machine idempotently
  5. observe — structured events, not log soup

why zap

  • wetrun: Dry-run by default — every change is previewed; you opt into execution explicitly.
  • deterministic: The plan is the same every run, so the same config always converges to the same machine.
  • idempotent: Run it as often as you like — zap detects what's already true and changes only what drifted.
  • local + SSH: One config converges your own machine or a remote host; only the target changes.
  • sandboxed eval: Configs run in a locked-down Deno subprocess — read-only, no network, scoped to the project — and emit plain JSON.
  • typed schema: Configs are TypeScript; bad states are rejected at plan time with a precise message, not late at apply.
  • legible to agents: deterministic plans and structured JSON events mean an LLM can drive zap as reliably as a human.
  • lock file: fetched files and source builds are pinned by blake3 hash in a zap.lock, so a moving ref resolves to the same bytes every time.

a config

A zap.ts is a function that receives a builder and declares resources. It runs in a sandboxed Deno subprocess and emits JSON — the plan zap converges to.

// zap.ts export default (zap) => { zap.target({local: true, package_manager: 'apt', service_manager: 'systemd'}); zap.pkg({id: 'curl', name: 'curl', from: {apt: 'curl'}}); zap.file({id: 'motd', path: '/etc/motd', content: {type: 'inline', content: 'hello\n'}}); zap.service({id: 'nginx', service: 'nginx', enabled: true}); };

what zap is

A pure-Rust CLI for convergent machine-state management. It installs arbitrary tools (deno, ghostty, zig…) and converges whole machines — packages, files, users, services, databases, firewalls, symlinks, and builds from source — over SSH or locally. Configs are authored in TypeScript with a JSON-serializable boundary, evaluated by Deno with restricted capabilities.

zap is the tool that deploys everything else — including the fuz forge it pulls signed release artifacts from. It is deliberately narrow:

  • not a forge — it deploys the forge, it doesn't host it.
  • not a sync tool — convergence is unidirectional and authoritative.
  • not a web app — Rust is the engine; this site is just docs.

v1 targets Debian/Ubuntu hosts — apt packages, systemd services, PostgreSQL databases, and ufw firewalls.