Module webdev 

The WebDev deploy/status actions (05-03, WEB-01 + WEB-02) — the hinge layer every tag command in 05-04..06 rides.

webdev_deploy installs the embedded route bundle (crate::webdev, 05-01) into the dedicated project through the 03-02 import machinery with overwrite=true — the CLI owns the project wholesale, so replace-not-merge is CORRECT here (research deploy guidance) and deploy is deliberately NOT --yes-guarded. The project is born from the first deploy zip: NO pre-flight create (Pitfall 10’s one-shot “resource already exists” quirk).

webdev_status probes every route’s version action and reports the per-route matrix ({present, absent, unlicensed, auth_gated, secret_mismatch, version_mismatch}) — a READ: exit 0 whenever the sweep completes, degradation is data (the doctor precedent).

webdev_precondition is the cheap refusal every WebDev-DEPENDENT command runs first (05-04+): absent routes or a version mismatch refuse exit 6 naming ign webdev deploy — the roadmap’s actionable-error criterion, no auto-upgrade magic.

The scriptExec secret lifecycle lives HERE: deploy generates a 32-byte hex secret from /dev/urandom (zero-dep — the workspace has no rand; unix-only is fine, no Windows CI is locked), persists it in the profile config at 0600 (the ONE value-carrying exception on crate::config::Profile, documented there), and bakes it into the route zip BEFORE upload. The secret NEVER appears in any action result, log, or JSON envelope — the redaction test below pins that.

Structs

RouteStatusRow

One route’s status-sweep row — ALL keys always.

WebdevDeployResult

ign webdev deploy result — ALL keys always (the agent shape); the import answer rides as the opaque-success object verbatim. The secret appears in NONE of them (redaction).

WebdevStatusResult

ign webdev status result — ALL keys always.

Enums

RouteStatus

The per-route status matrix (WebDev-dependent commands refuse on the same discrimination; status reports it as data).

Functions

webdev_deploy

ign webdev deploy — pack the embedded bundle, import it overwrite-style, own the secret lifecycle.

webdev_precondition

The cheap precondition every WebDev-DEPENDENT command runs first (05-04’s tags family onward): probe the canonical tags route and refuse with the actionable matrix — absent → routes_not_deployed (exit 6, hint names ign webdev deploy), version mismatch → route_version_mismatch (hint direction-aware: redeploy or update ign), unlicensed → webdev_unlicensed. No auto-upgrade magic.

webdev_status

ign webdev status — the version-handshake sweep. The 4 always-on routes always ride; scriptExec’s version action is probed ONLY when a secret is configured (its header rides along — research OQ4: AuthGated → auth_gated, secret denials → secret_mismatch).