# Antideploy

Deploy an application from a directory. No Dockerfile, no YAML, no cloud console.

## Start here

The complete machine-readable contract is one unauthenticated GET:

    https://antideploy.com/api/v1

Fetch it before doing anything else. It carries every endpoint, request shape,
error code and limit, and its `start` section is the whole path from an empty
terminal to a live URL. Nothing else needs to be read first.

## The short version

1. Log in, if ~/.antideploy/config.json has no token yet.
   POST https://antideploy.com/api/v1/device/code, show the user the verificationUriComplete it
   returns, then poll POST https://antideploy.com/api/v1/device/token until it grants a token.
   The user clicks Approve once. That is the only human step in the whole flow.

2. Create the application, if the project has no .antideploy.json.
   POST https://antideploy.com/api/v1/applications with {"name":"<folder name>"}. Save the
   returned applicationId to .antideploy.json. It holds no secret and can be
   committed.

   Ask your user for the address first. The app is published at
   <subdomain>.antideploy.com, and that is the link they will send people, so it
   is theirs to choose and not yours to guess. Ask what they want, check it
   with GET https://antideploy.com/api/v1/hostnames/check?label=<label>, show them the full
   URL, then pass it as {"name":"...","subdomain":"..."}.

   Skip the question only if they have already told you what to call it.
   Omitting "subdomain" is allowed and derives one from the name, numbering
   past a collision, but then the address is our guess rather than their
   choice. Changing it later is PATCH https://antideploy.com/api/v1/applications/<id>
   with {"subdomain":"..."}, and the old address stops working at once.

3. Deploy, and poll until it finishes.
   tar the directory to POST https://antideploy.com/api/v1/deploy?applicationId=<id>, then poll
   the watch URL it returns.

Steps 1 and 2 happen once. Every later deploy is step 3 alone.

## Handling the token

Write it to a file with a redirect. Never echo it, never print it, and never ask
a user to paste a credential into a chat. An account token in terminal output is
a live credential in scrollback and in your own transcript.

It does not belong in the project directory. ~/.antideploy/config.json, mode
0600. Project keys (prefix ad_) are the ones built to survive being committed;
account tokens (prefix adu_) are not.

## Do not

- Do not send a user to the dashboard to create a key by hand. Older
  documentation says to. It is no longer necessary and it is the step this flow
  exists to remove.
- Do not upload only an entry point. Send the whole project directory, or the
  site deploys successfully and serves a page whose assets 404.
- Do not use Python's urllib. Its default user-agent is rejected at the edge.
  requests and curl are both fine.

## Prose documentation

https://antideploy.com/docs/llms.txt — written for people, and predates the terminal login.
Where it disagrees with https://antideploy.com/api/v1, the API is correct.