barnctl

#!/usr/bin/env zsh

VERSION=0.24.2

SCRIPT_DIR=${${0:a}%/*}

function ___ {
}

function zsh_parse_arguments {
    typeset error=${${1:-}:q} context=${${2:-}:q}
    shift 2

    # TODO -hfoo will become $o_help and then set -- foo
    typeset -A arguments declared localized arg
    typeset regex short long remainder

    while :
    do
        case "$1" in
            # Indicates send of parser arguments.
            -- )
                shift
                break
                ;;
            # Parse program arguments.
            * )
                # Check for a variable name or else we'll generate an `o_` prefixed one.
                if [[ "$1" =~ ^([^,]+)=(.*)$ ]]; then
                    arg[variable]="$match[1]"
                    pattern="$match[2]"
                else
                    arg[variable]=
                    pattern="$1"
                fi

                shift

                regex='^([a-zA-Z0-9]{0,2}),([^%@:#!]*)([%@:#!]?)(.*)$'
                [[ "$pattern" =~ $regex ]] || { printf '%s definition %q' $error "$1"; return; }
                short=${match[1]} long=${match[2]} arg[kind]=${match[3]} arg[remainder]="${match[4]}"

                [[ -z "$arg[variable]" ]] && {
                    [[ -z "$long" ]] && arg[variable]=o_$short || arg[variable]=o_${long:gs/-/_/}
                }

                case "x$arg[kind]" in
                    x@ )
                        arg[type_flag]=' -a'
                        arg[type_name]='array-local'
                        ;;
                    x% )
                        arg[type_flag]=' -A'
                        arg[type_name]='association-local'
                        [[ -z "$arg[remainder]" ]] && arg[remainder]==
                        ;;
                    * )
                        arg[type_flag]=' '
                        arg[type_name]='scalar-local'
                        ;;
                esac

                [[ -n "$long" ]] && arguments[--${long}]="${(@qq)${(@kv)arg}}"
                [[ -n "$short" ]] && arguments[-${short}]="${(@qq)${(@kv)arg}}"

                [[ "declared[$arg[variable]]" = 1 ]] && continue
                case x"$arg[kind]" in
                    x | x\! | x\# )
                        printf '{ [[ ! -v %s ]] || [[ "${(t)%s}" != "scalar-local" ]] } && local %s\n' \
                            "$arg[variable]" "$arg[variable]" "$arg[variable]"
                        case "x$arg[kind]" in
                            x | x\# )
                                printf '%s=0\n' "$arg[variable]"
                                ;;
                            * )
                                printf '%s=1\n' "$arg[variable]"
                                ;;
                        esac
                        ;;
                esac
                declared[$arg[variable]]=1
                ;;
        esac
    done

    typeset -a args=( "$@" ) split
    typeset i=1 arged flag negated delimiter
    while (( i <= ${#args[@]} )); do
        negated=0
        case "${args[$i]}" in
            - )
                break
                ;;
            -- )
                let i=i+1
                break
                ;;
            --no-* )
                regex='^--no-([a-zA-Z0-9][-a-zA-Z0-9]*)$'
                if [[ "${args[$i]}" =~ $regex ]] && [[ -n "${arguments[--$match[1]]}" ]]; then
                    arg=( "${(@Q)${(@z)${arguments[--$match[1]]}}}" )
                    if [[ $arg[kind] == '!' ]]; then
                        args[$i]="--${match[1]}"
                        negated=1
                    fi
                fi
                ;&
            --* )
                arged=0
                regex='^(--[-a-zA-Z0-9]+)(=.*)?$'
                [[ "${args[$i]}" =~ $regex ]] || { printf '%s unknown %s %q\n' $error $context "$1"; return; }
                long="${match[1]}"
                if [[ "$match[2]" != '' ]]; then
                    arged=1
                    args[i]=${match[2]:1}
                else
                    ((i++))
                fi
                flag=$long
                [[ -z "${arguments[$long]}" ]] && { printf '%s unknown %s %q\n' $error $context "$long"; return; }
                arg=( "${(@Q)${(@z)${arguments[$long]}}}" )
                ;;
            -* )
                arged=0
                # NB Oh, it's one or for an array, but for strings we start from zero. I see.
                flag=${args[$i]:0:2}
                [[ -z "${arguments[$flag]}" ]] && { printf '%s unknown %s %q\n' $error $context "$flag"; return; }
                arg=( "${(@Q)${(@z)${arguments[$flag]}}}" )
                case "x$arg[kind]" in
                    x: | x@ )
                        if [[ ${#args[$i]} -eq 2 ]]; then
                            let i=i+1
                        else
                            args[i]=${args[$i]:2}
                        fi
                        ;;
                    * )
                        # TODO If you have args a b and c and you get -abd what
                        # does getopt do? Seems to just append...
                        if [[ ${#args[i]} -gt 2 ]]; then
                            args[i]="-${args[i]:2}"
                        else
                            ((i++))
                        fi
                        [[ "$arg[kind]" = '!' ]] && negated=1
                        ;;
                esac
                ;;
            *)
                break
                ;;
        esac
        case "x$arg[kind]" in
            x | x\# | x\! )
                (( $arged )) && { printf '%s no_args %s %q\n' $error $context "$flag"; return; }
                ;;
        esac
        case "x$arg[kind]" in
            x )
                printf 'local %s=1\n' "$arg[variable]"
                ;;
            x\# )
                printf '((%s++))\n' "$arg[variable]"
                ;;
            x\! )
                if (( $negated )); then
                    printf '%s=0\n' "$arg[variable]"
                else
                    printf '%s=1\n' "$arg[variable]"
                fi
                ;;
            * )
                (( i <= ${#args[@]} )) || { printf '%s arg_missing %s %q\n' $error $context "$flag"; return; }
                if [[ "$localized[$arg[variable]]" != 1 ]]; then
                    printf '{ [[ ! -v %s ]] || [[ "${(t)%s}" != %s ]] } && typeset%s %s\n' \
                        "$arg[variable]" "$arg[variable]" \
                        "$arg[type_name]" "$arg[type_flag]" "$arg[variable]"
                fi
                case "x$arg[kind]" in
                    x: )
                        printf '%s=%s\n' "$arg[variable]" "${args[$i]:q}"
                        ((i++))
                        ;;
                    * )
                        [[ "$localized[$arg[variable]]" != 1 ]] && printf '%s=()\n' "$arg[variable]"
                        case "x$arg[kind]" in
                            x@ )
                                printf '%s+=(%s)\n' "$arg[variable]" "${args[$i]:q}"
                                ((i++))
                                ;;
                            x% )
                                delimiter=$arg[remainder]
                                split=("${(@ps:$delimiter:)args[2]}")
                                if (( ${#split[@]} == 1 )); then
                                    (( i + 1 <= ${#args[@]} )) || {
                                        print -R "$error $context arg_missing ${flag:q}"; return;
                                    }
                                    printf '%s+=(%s %s)\n' "$arg[variable]" "${args[$i]:q}" "${args[$i+1]:q}"
                                    ((i+=2))
                                else
                                    printf '%s+=(%s %s)\n' "$arg[variable]" \
                                        "${split[1]:q}" "${(pj:$delimiter:)${(@)split[2,-1]}}"
                                    ((i++))
                                fi
                                ;;
                        esac
                        ;;
                esac
                localized[$arg[variable]]=1
                ;;
            * )
        esac
    done

    (( i ==  ${#args[@]} + 1 )) && printf 'set --\n' || printf 'set -- %s\n' "${(j: :)${(@qq)${(@)args[$i,-1]}}}"
}

function acrectl_parse_arguments_error {
    print -R -u 2 -- "$@"
    exit 1
}

function barnctl_parse_arguments {
    zsh_parse_arguments barnctl_argument_error "$@"
    echo "(( \$o_help )) && usage_$1"
}

IFS=$'\n' read -d '' -r -A BARNCTL_COMMANDS < <( \
    sed -n 's/^function barnctl_command_\(.*\) {$/\1/p' "$SCRIPT_DIR/barnctl" \
)

function barnctl_next_command {
    typeset prefix=$1 command=$2
    shift 2
    for func in "${BARNCTL_COMMANDS[@]}"; do
        if [[ "$func" == "$prefix$command" ]]; then
            "barnctl_command_$func" "$@"
            return
        fi
    done
    abend <<'    EOF'
        error: no such command \`barnctl ${prefix:gs/_/ }$command\`
    EOF
}

___ barnctl_common ___
function @_args {
    typeset key value
    typeset -A arguments arrays associative_arrays scalars seen
    typeset -a array remainder
    while (( $# != 0 )); do
        key="${1/%=*/=}"
        case "$1" in
            %* )
                key=${1#%}
                associative_arrays[$key]=0
                if (( ${+arguments[$key]} )); then
                    array=("${(@Q)${(@z)arguments[$key]}}")
                else
                    array=()
                fi
                array+=("${(@kv)${(P)key}}")
                arguments[$key]="${(@qq)${array[@]}}"
                ;;
            * )
                key="${1/%=*/=}"
                case "$key" in
                    *+= )
                        key="${key%+=}"
                        value="${1#*=}"
                        arrays[$key]=0
                        if (( ${+arguments[$key]} )); then
                            array=("${(@Q)${(@z)arguments[$key]}}")
                        else
                            array=()
                        fi
                        array+=("$value")
                        arguments[$key]="${(@qq)${array[@]}}"
                        ;;
                    *= )
                        key="${key%=}"
                        value="${1#*=}"
                        scalars[$key]=0
                        arguments[$key]=${value:q}
                        ;;
                    * )
                        remainder+=("$1")
                        ;;
                esac
                ;;
        esac
        shift
    done
    typeset variable
    for variable in "${(@k)associative_arrays}"; do
        print -R "typeset -A $variable=($arguments[$variable])"
    done
    for variable in "${(@k)arrays}"; do
        print -R "typeset -a $variable=($arguments[$variable])"
    done
    for variable in "${(@k)scalars}"; do
        print -R "typeset $variable=$arguments[$variable]"
    done
    [[ 0 -eq ${#remainder[@]} ]] && print -R "set --" || print -R "set -- ${(@qq)remainder[@]}"
}


function barnctl_get_array {
    [[ -n "${${(P)1}[$2]}" ]] && : ${(PA)3::=${(@Q)${(@z)${(P)1}[$2]}}}
}

function barnctl_read_config_ {
    typeset file=${2:-} regex='^([^+=]+)(\+?=)(.*)$' line
    shift 2
    while [[ $# -ne 0 ]]; do
        barnctl_read_config[$1]=${2:-}
        shift 2
    done
    typeset -a array
    while read -r line; do
        [[ "$line" =~ $regex ]] || abend bad_config "$config"
        typeset key=$match[1] element_type=$match[2] value=$match[3]
        case "$element_type" in
            += )
                if (( ${+barnctl_read_config[$key]} )); then
                    array=("${(@Q)${(@z)barnctl_read_config[$key]}}")
                else
                    array=()
                fi
                array+=("$value")
                barnctl_read_config[$key]="${(@qq)${array[@]}}"
                ;;
            = )
                barnctl_read_config[$key]="$value"
                ;;
        esac
    done < "$file"
}

function barnctl_read_config {
    [[ $(( $# % 2 )) == 0 ]] || abend bad_argument_count
    typeset -A barnctl_read_config
    barnctl_read_config_ "$@"
    : ${(PA)${1:-reply}::=${(@kv)barnctl_read_config}}
}

function barnctl_quotedoc {
    typeset spaces=65536 leading='^( *)([^[:space:]])' IFS='' dedented
    typeset -a lines
    while read -r line; do
        lines+=("$line")
        if [[ "$line" =~ $leading && "${#match[1]}" -lt "$spaces" ]]; then
            spaces="${#match[1]}"
        fi
    done < /dev/stdin
    read -r -d '' dedented < <(printf "%s\n" "${lines[@]}" | sed -E 's/^ {'$spaces'}//')
    eval "$({
        echo "cat <<EOF"
        echo -n "$dedented"
        echo "EOF"
    })"
}

function abend {
    barnctl_quotedoc < <(cat) 1>&2
    exit 1
}

function warn {
    barnctl_quotedoc < /dev/stdin 1>&2
}
___

function barnctl_shell_resource {
    awk '/^___ '$1' ___/{flag=1;next}/^___/{flag=0}flag' "$SCRIPT_DIR/barnctl"
}

function barnctl_command_systemd_always {
    eval "$(barnctl_parse_arguments systemd_always "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-}
    shift

    ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" "/usr/bin/sudo /usr/local/bin/barnyard systemd always --version $VERSION ${(j: :)${(@)@:q}}"
}

function barnctl_command_systemd_apply {
    eval "$(barnctl_parse_arguments systemd_apply "d,dry-run" "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset dry_run
    (( $o_dry_run )) && dry_run='--dry-run'

    typeset server=${1:-}
    shift

    ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" "/usr/bin/sudo /usr/local/bin/barnyard systemd apply $dry_run --version $VERSION"
}

function barnctl_command_systemd {
    eval "$(barnctl_parse_arguments systemd "h,help" -- "$@")"
    barnctl_next_command systemd_ "$@"
}

function barnctl_command_always {
    eval "$(barnctl_parse_arguments always "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-}
    shift

    ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" "/usr/bin/sudo /usr/local/bin/barnyard always --version $VERSION ${(j: :)${(@)@:q}}"
}

function barnctl_command_apply {
    eval "$(barnctl_parse_arguments apply "d,dry-run" "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset dry_run
    (( $o_dry_run )) && dry_run='--dry-run'

    typeset server=${1:-}

    ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" "/usr/bin/sudo /usr/local/bin/barnyard apply $dry_run --version $VERSION"
}

# For when you forget the SSH protocol. SSH will invoke a shell with the `-c`
# argument followed by a single command. If you want to pass arguments that
# single command would be something like `sh -c 'program hello,\ world'`. This
# is why we always generate a script and pipe to Bash. We know we get Bash and
# not an arbitray user shell and we don't have to do argument parser. We won't
# leak secrets by turning them into arguments for `ps` interception. Our
# server-side `barnyard` executable has commands to simplify  the construction
# of the scripts here.

function barnctl_command_bootstrap {
    typeset -a o_gpg o_fingerprint
    eval "$(barnctl_parse_arguments bootstrap h,help g,gpg@ f,fingerprint@ k,known: s,ssh: c,clone: -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-} slurp gpg fingerprint

    # We get into trouble when a file does not end with a new line and we try to
    # make a HEREDOC from it. The `EOF` of the HEREDOC will not appear on a new
    # line. So, we read our files into a varaible using `$(cat)` so that the
    # process substituion will strip all new lines. We know there are none so we
    # can add just one.

    {
        print 'set -e'
        if [[ -v o_known ]]; then
            slurp=$(cat "$o_known")
            printf 'cat <<EOF | barnyard ssh known-hosts --version=%q - || exit 1\n' $VERSION
            printf '%s\n' "$slurp"
            print EOF
        fi
        if [[ -v o_ssh ]]; then
            slurp=$(cat "$o_ssh")
            printf 'cat <<EOF | barnyard ssh private-key --version=%q - || exit 1\n' $VERSION
            printf '%s\n' "$slurp"
            print EOF
        fi
        for gpg in "${(@)o_gpg}"; do
            slurp=$(cat "$gpg")
            printf 'cat <<EOF | barnyard gpg import --version=%q - || exit 1\n' $VERSION
            printf '%s\n' "$slurp"
            print EOF
        done
        for fingerprint in "${(@)o_fingerprint}"; do
            printf 'barnyard gpg trust --version=%q %q || exit 1\n' $VERSION "$fingerprint"
        done
        if [[ -v o_clone ]]; then
            printf 'barnyard clone --version=%q %q || exit 1\n' $VERSION "$o_clone"
        fi
        if (( ${#o_gpg} || ${#o_fingerprint} )); then
            printf 'GNUPGHOME=/etc/barnyard/gnupg gpg --list-keys\n'
        fi
    } | ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" '/usr/bin/sudo /bin/bash'
}

function assert_barnyard_directory {
    [[ -d age && -d machines && -d ../code && -d resources ]] || abend<<'    EOF'
        error: barnyard utilties must be run in the barnyard directory
    EOF
}

function barnctl_command_commit {
    eval "$(barnctl_parse_arguments commit "h,help" -- "$@")"

    assert_barnyard_directory

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-}

    ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" "/usr/local/bin/barnyard commit --version $VERSION"
}

function configure_or_unconfigure {
    typeset operation=${1:-} hostname=${2:-}
    shift 2

    assert_barnyard_directory

    [[ -d "machines/$hostname" ]] || abend<<'    EOF'
        error: hostname configuration not found
    EOF
    typeset -a modules
    if (( ! $# )); then
        for module in machines/$hostname/*; do
            modules+=(${module##*/})
        done
    else
        modules=("$@")
    fi
    typeset -A o_module
    for module in "${modules[@]}"; do
        o_module=()
        barnctl_read_config o_module machines/$hostname/$module
        if [[ -z "$o_module[_module]" ]]; then
            o_module[_module]=$module
        fi
        if [[ -e ../code/modules/$o_module[_module]/$operation.zsh ]]; then
            zsh <(barnctl_shell_resource barnctl_configure) \
                $SCRIPT_DIR $PWD $hostname $o_module[_module] $module $operation || abend<<'            EOF'
                $operation module \`$module\` failed
            EOF
        fi
    done
}

function barnctl_command_configure {
    eval "$(barnctl_parse_arguments apply "h,help" -- "$@")"
    configure_or_unconfigure configure "$@"
}

function barnctl_command_unconfigure {
    eval "$(barnctl_parse_arguments unconfigure "h,help" -- "$@")"
    configure_or_unconfigure unconfigure "$@"
}

function barnctl_command_generate {
    typeset o_include='*'
    eval "$(barnctl_parse_arguments generate "h,help" "i,include:" "e,exclude:" -- "$@")"

    typeset configuration generate now=$(date +%s)

    generate="$({
        barnctl_shell_resource barnctl_common
        print ''
        barnctl_shell_resource barnctl_generate
    })"

    for configuration in "$@"; do
        [[ ${configuration#*.} != zsh ]] && continue
        zsh -c "$generate" -- "$o_include" "$o_exclude" "$configuration" || exit 1
    done
}

function barnctl_command_inventory {
    typeset o_include='*'
    eval "$(barnctl_parse_arguments inventory "h,help" "i,include:" "e,exclude:" -- "$@")"

    typeset inventory configuration

    inventory="$({
        barnctl_shell_resource barnctl_common
        print ''
        barnctl_shell_resource barnctl_inventory
    })"

    for configuration in "$@"; do
        [[ ${configuration#*.} != zsh ]] && continue
        zsh -c "$inventory" -- "$o_include" "$o_exclude" "$configuration" || exit 1
    done
}

function barnctl_command_prepare {
    eval "$(barnctl_parse_arguments prepare "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-}

    {
        print -R 'set -e'
        print -R 'BARNYARD_SOURCE=$(cat <<'"'"EOS"'"
        sed 's/VERSION=.*/VERSION='$VERSION'/' "${SCRIPT_DIR}/barnyard"
        print -R 'EOS'
        print -R ')'
        print -R ''
        barnctl_shell_resource barnctl_prepare
    } | ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" '/usr/bin/sudo /bin/bash'
}

function barnctl_command_upgrade {
    eval "$(barnctl_parse_arguments upgrade "h,help" -- "$@")"

    (( $# )) || abend<<'    EOF'
        erorr: ssh hostname is required
    EOF

    typeset server=${1:-}

    {
        print -R 'set -e'
        print -R 'BARNYARD_SOURCE=$(cat <<'"'"EOF"'"
        sed 's/VERSION=.*/VERSION='$VERSION'/' "${SCRIPT_DIR}/barnyard"
        print -R 'EOF'
        print -R ')'
        print -R ''
        print -R 'VERSION='$VERSION
        print -R ''
        barnctl_shell_resource barnctl_upgrade
    } | ssh -o ConnectTimeout=30 -o ConnectionAttempts=1 "$server" '/usr/bin/sudo /bin/bash'
}

function barnctl_command_version {
    eval "$(barnctl_parse_arguments version "h,help" -- "$@")"
    print -R "$VERSION"
}


function {
    eval "$(barnctl_parse_arguments root "h,help" -- "$@")"
    barnctl_next_command "" "$@"
} "$@"

exit

# Any keys specific to the machine permanent and are never updated. If a key
# specific to the machine is compromised, it means the machine is compromised,
# because the key never leaves the machine.

___ barnctl_prepare ___
barnyard_divider() {
    typeset label=${1:-}
    typeset bar=--------------------------------------------------------------------------------
    shift
    typeset prefix="------- $label "
    echo "$bar"
    echo "$prefix ${bar:0:$(( ${#bar} - ${#prefix} - 1 ))}"
    echo "$bar"
}
barnyard_divider 'apt update'
apt-get update
barnyard_divider 'install zsh, gnupg2, git'
apt-get install -y zsh gnupg2 git
barnyard_divider 'install barnyard'
echo "$BARNYARD_SOURCE" > /usr/local/bin/barnyard
chmod 755 /usr/local/bin/barnyard
barnyard version
barnyard prepare
___ barnctl_upgrade ___
if [[ -e /usr/local/bin/barnyard ]]; then
    if ! grep -q '^VERSION=' /usr/local/bin/barnyard; then
        version=0.0.0
    else
        version=$(grep '^VERSION=' /usr/local/bin/barnyard | sed 's/^VERSION=//')
    fi
else
    version=$VERSION
fi
rm -f /usr/local/bin/barnyard
echo "$BARNYARD_SOURCE" > /usr/local/bin/barnyard
chmod +x /usr/local/bin/barnyard
echo "version: $version"
if [[ "$version" != "$VERSION" ]]; then
    case "$version" in
        0.0.0 )
            echo 'upgrade: 0.0.0 -> 0.1.0'
            apt-get install -y zsh
            if [[ ! -d /var/lib/barnyard && -d /var/barnyard ]]; then
                echo "######### mv /var/barnyard /var/lib/barnyar ##########"
                mv /var/barnyard /var/lib/barnyard
            fi
            version=0.1.0
            ;& # fall through
        * )
            echo "upgrade: $version -> $(barnyard version)"
            ;;
    esac
    echo "version: $(barnyard version)"
fi
___ barnctl_configure ___
source <(awk '/^___ barnctl_common ___/{flag=1;next}/^___/{flag=0}flag' "$1/barnctl")

shift

function {
    typeset -A o_barnyard=( o_force '0' ) o_module o_registers
    typeset module=${3:-}
    o_barnyard[barnyard]=${1:-} o_barnyard[hostname]=${2:-} o_barnyard[module]=${4:-} o_barnyard[operation]=${5:-}
    shift 3
    o_barnyard[resources]="${o_barnyard[barnyard]}/resources/${o_barnyard[hostname]}"
    o_barnyard[age]=$(<"${o_barnyard[barnyard]}/age/${o_barnyard[hostname]}")
    barnctl_read_config o_module "${o_barnyard[barnyard]}/machines/${o_barnyard[hostname]}/${o_barnyard[module]}"
    source "${o_barnyard[barnyard]}/../code/modules/$module/${o_barnyard[operation]}.zsh"
} "$@"
___ barnctl_generate ___
function __barnyard_read_config {
    [[ $(( $# % 2 )) == 0 ]] || abend bad_argument_count
}

function machine {
    typeset hostname=${1:-}
    shift
    typeset disabled=$@[(Ie)enabled=0]
    o_barnyard[hostname]=$hostname
    __o_registers[order]=0
    __o_registers[excluded]=1
    if [[ "$hostname" = $~o_barnyard[include] && ( -z $o_barnyard[exclude] || "$hostname" != $~o_barnyard[exclude] ) ]] ; then
        if (( disabled )); then
            rm -rf "age/${hostname}"
            rm -rf "machines/${hostname}"
            rm -rf "resources/${hostname}"
        else
            __o_registers[excluded]=0
            rm -rf "machines/${hostname}"
            mkdir -p "machines/${hostname}"
            printf '_apply=never\n' > "machines/${hostname}/order"
            @ machine "$@" _appply=never
            o_machine=()
            function {
                typeset regex='^([^+=]+)(\+?=)(.*)$' line array=() key element_type value
                while read -r line; do
                    [[ $line =~ $regex ]] || { print -u 2 bad_config $config; exit 1 }
                    key=$match[1] element_type=$match[2] value=$match[3]
                    case "$element_type" in
                        += )
                            if (( ${+o_machine[$key]} )); then
                                array=( "${(@Q)${(@z)o_machine[$key]}}" )
                            else
                                array=()
                            fi
                            array+=( $value )
                            o_machine[$key]=${(@qq)${array[@]}}
                            ;;
                        = )
                            o_machine[$key]=$value
                            ;;
                    esac
                done < machines/$hostname/machine
            }
        fi
    fi
}

function @ {
    (( $__o_registers[excluded] )) && return
    typeset module=${1:-}
    shift
    [[ -z $module ]] && abend<<'    EOF'
        error: module name is required
    EOF
    typeset regex='[a-z0-9_@]+'
    [[ "${module:1}" =~ $regex ]] || abend<<'    EOF'
        error: invalid module name $module
    EOF
    if [[ $module[1] =~ @ ]]; then
        $module "$@"
        return
    fi
    typeset filename key value
    filename="machines/${o_barnyard[hostname]}/$module"
    # print -R "_order=$__o_registers[order]" > "$filename"
    touch "$filename"
    printf 'module+=%s\n' "$module" >> "machines/${o_barnyard[hostname]}/order"
    while (( $# != 0 )); do
        if [[ -d "../code/$1" ]]; then
            print -R "_module=${1#modules/}" >> "$filename"
            shift
            continue
        fi
        key="${1/#*=/=}"
        case "${1/%=*/=}" in
            once | diff | always | never )
                print -R "_apply=$1" >> "$filename"
                ;;
            *@= )
                value="${1#*=}"
                if (( ${#${(@P)value}[@]} )); then
                    key="${1%%@=*}"
                    for value in "${(@P)value}"; do
                        printf '%s+=%s\n' "$key" "$value" >> "$filename"
                    done
                fi
                ;;
            *+= | *\= )
                printf '%s\n' "$1" >> "$filename"
                ;;
            %* )
                value="${1#%}"
                for key value in "${(@Pkv)value}"; do
                    print -R "$key=$value" >> "$filename"
                done
                ;;
            - )
                barnctl_quotedoc >> "$filename"
                ;;
            * )
                case "$1" in
                    %* )
                        for key value in "${@(kv){(P)${1#%}}}"; do
                            print -R "$key+=" >> "$filename"
                        done
                        ;;
                    * )
                        abend <<'                        EOF'
                            error: unknown module value: value: $1, module: $module, machine: $o_barnyard[hostname]
                        EOF
                        ;;
                esac
                ;;
        esac
        shift
    done
    __o_registers[order]=$(( __o_registers[order] + 1 ))
}

function {
    typeset -A o_machine o_barnyard __o_registers
    o_barnyard[include]=${1:-}
    o_barnyard[exclude]=${2:-}
    o_barnyard[configuration]=${3:-}
    shift 3
    source $o_barnyard[configuration]
} "$@"
___
___ barnctl_inventory ___
function @ {
    true
}

function machine {
    typeset hostname=${1:-}
    shift
    typeset disabled=$@[(Ie)enabled=0]
    o_barnyard[hostname]="$hostname"
    if [[ $disabled -eq 0 && "$hostname" = $~o_barnyard[include] && ( -z $o_barnyard[exclude] || "$hostname" != $~o_barnyard[exclude] ) ]] ; then
        printf '<machine>: '
        printf ' %q' "$hostname"
        printf '\n'
    fi
}

function {
    typeset -A o_barnyard __o_registers
    o_barnyard[include]=${1:-}
    o_barnyard[exclude]=${2:-}
    o_barnyard[configuration]=${3:-}
    shift
    source "$o_barnyard[configuration]"
} "$@"
___