feat: deploy lib

Cargo.toml

@@ -61,6 +61,7 @@ ic-utils = { version = "0.49.1" }
 icp = { path = "crates/icp" }
 icp-canister-interfaces = { path = "crates/icp-canister-interfaces" }
 icp-events = { path = "crates/icp-events" }
+icp-deploy-canister = { path = "crates/icp-deploy-canister" }
 icp-sync-plugin = { path = "crates/icp-sync-plugin" }
 ic-identity-hsm = "0.49.1"
 icrc-ledger-types = "0.1.10"

crates/icp-cli/src/commands/canister/install.rs

@@ -183,6 +183,8 @@ pub(crate) async fn exec(ctx: &Context, args: &InstallArgs) -> Result<(), anyhow
         }
     }
 
+    // Install the bytes read above, not a fresh read of the same source, so the
+    // module installed is the one the Candid check ran against.
     install_canister(
         &agent,
         args.proxy,

crates/icp-cli/src/commands/sync.rs

@@ -9,7 +9,10 @@ use icp::identity::IdentitySelection;
 use std::collections::BTreeMap;
 use tracing::info;
 
-use icp::operations::{proxy_management, sync::sync_many};
+use icp::Canister;
+use icp::operations::{
+    binding_env_vars::set_binding_env_vars_many, proxy_management, sync::sync_many,
+};
 
 use crate::{
     options::{EnvironmentOpt, IdentityOpt},
@@ -126,13 +129,32 @@ pub(crate) async fn exec(ctx: &Context, args: &SyncArgs) -> Result<(), anyhow::E
         .into_iter()
         .collect();
 
-    let pkg_cache = ctx.dirs.package_cache()?;
     let project_dir = ctx.project.load().await?.dir;
     let urls = ctx.network.urls(&env.network).await?;
+    let resolver = ctx.resource_resolver()?;
+
+    // Apply the generated `PUBLIC_CANISTER_ID:*` environment variables before
+    // syncing. `deploy` does this, but standalone `icp sync` previously did not,
+    // so a synced canister could run against stale/absent binding ids.
+    let target_canisters: Vec<(Principal, Canister)> = sync_canisters
+        .iter()
+        .map(|(cid, _, info)| (*cid, info.clone()))
+        .collect();
 
     rendered(ctx.debug, async |reporter| {
+        set_binding_env_vars_many(
+            agent.clone(),
+            args.proxy,
+            environment_selection.name(),
+            target_canisters,
+            canister_ids.clone(),
+            reporter,
+        )
+        .await?;
+
         sync_many(
             ctx.syncer.clone(),
+            resolver,
             agent,
             sync_canisters,
             project_dir,
@@ -141,10 +163,11 @@ pub(crate) async fn exec(ctx: &Context, args: &SyncArgs) -> Result<(), anyhow::E
             urls,
             canister_ids,
             args.proxy,
-            &pkg_cache,
             reporter,
         )
-        .await
+        .await?;
+
+        Ok::<_, anyhow::Error>(())
     })
     .await?;
 

crates/icp-deploy-canister/Cargo.toml

@@ -0,0 +1,51 @@
+[package]
+name = "icp-deploy-canister"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
+publish.workspace = true
+
+# This crate is intentionally dependency-light so that its install/sync core and
+# project model can be compiled into a canister. All host-only IO (filesystem,
+# HTTP, the ICP API, sync-step execution, the canister-id store) is abstracted
+# behind trait objects; do NOT add ic-agent, reqwest, tokio, wasmtime, keyring,
+# bollard, sysinfo, or std::fs-driven crates here.
+
+[features]
+# Enables `clap::ValueEnum` derives on manifest enums used as CLI value types
+# (e.g. `ArgsFormat`). Enabled transitively by `icp/clap`.
+clap = ["dep:clap"]
+
+[dependencies]
+async-trait.workspace = true
+bigdecimal.workspace = true
+camino.workspace = true
+candid.workspace = true
+clap = { workspace = true, optional = true }
+candid_parser.workspace = true
+futures.workspace = true
+glob.workspace = true
+handlebars.workspace = true
+hex.workspace = true
+ic-management-canister-types.workspace = true
+indexmap.workspace = true
+itertools.workspace = true
+num-bigint.workspace = true
+num-integer.workspace = true
+num-traits.workspace = true
+pathdiff.workspace = true
+schemars.workspace = true
+serde.workspace = true
+sha2.workspace = true
+serde_json.workspace = true
+serde_yaml.workspace = true
+snafu.workspace = true
+strum.workspace = true
+tracing.workspace = true
+url.workspace = true
+
+[dev-dependencies]
+camino-tempfile.workspace = true
+indoc.workspace = true
+jsonschema.workspace = true
+tokio.workspace = true