zap.ts

Declare the zap.target({...}) machine descriptor (local or remote SSH).

Declare the zap.deploy({...}) release-management block zap deploy ships with.

A reference to the operator environment variable name: the value is read from the environment of the machine zap runs on, when the field holding the reference is used — never while the config is evaluated, which has no environment.

The result is a string to place in a field that takes a reference — whole (host: zap.env('DEPLOY_HOST')), interpolated into a template literal, or concatenated (path: '/srv/' + zap.env('APP') + '/data'). It is opaque: it holds a marker, not the value, so slicing, splitting, case-changing, or encoding it leaves something that is no longer a reference: the config fails to evaluate when part of the marker survives, and otherwise the result is ordinary text. A field that takes no reference rejects one, naming the field. A recipe, which has no builder, calls env_ref from @fuzdev/zap/env_ref.ts for the same string.

a marked string standing for the variable's value

Declare env-var names secret: ones zap doesn't recognize by where they are used, their name, or the form of their value. Each is a variable's name — 'LICENSE_CODE', not zap.env('LICENSE_CODE') — and POSIX ([A-Za-z_][A-Za-z0-9_]*); anything else throws when called.

Declare env-var names not secret, where zap reads one as a secret by its name or the form of its value and it isn't. Each is a variable's name, POSIX ([A-Za-z_][A-Za-z0-9_]*); anything else throws when called. Unmasking a variable the config uses as a fetch credential (auth) is rejected when the config is read.

Declare a package resource — a system package via a package manager.

Declare an apt_repo resource — a GPG key + sources list.

Declare a script resource — an idempotent command (check / run).

Declare an installer resource — software via a curl-piped script.

Declare a user resource — a Unix user (shell, home mode, SSH keys, sudoers).

Declare a directory resource — a directory with managed permissions.

Declare a file resource — a file with managed content.

Declare a link resource — a symbolic link.

Declare a service resource — service lifecycle management.

Declare a database resource (PostgreSQL only).

Declare a swap resource — a swap file.

Declare a firewall resource — firewall rules (ufw or nftables).

Declare a verify resource — assertions checked at detection and again at its place in dependency order on a wetrun; one still failing there fails the run.

Declare a pipeline resource — imperative multi-step execution.

Declare a build resource — fetch a verified source, build it, install to output.