@cicore/cli 1.0.0

package/dist/commands/brand/index.d.ts

@@ -0,0 +1,54 @@
+/**
+ * CiCore CLI — `ci brand reconcile` (control-plane → node state)
+ *
+ * The reproducibility keystone (plan B2). The control-plane DB
+ * (`vucore_control`: `cp_brands` + `cp_domains`) is the single source of
+ * truth; this command *renders* the derived node state from it, idempotently:
+ *
+ *   1. brand.json — projects each active brand's identity into
+ *      `cores/<slug>/brand.json` (logo/title/theme) so the Nuxt runtime
+ *      (core-loader → useBrand → VBrandLogo + titleTemplate) reflects it.
+ *      Canonical writer; `BrandService::reconcileBrandJson` (PHP) mirrors it.
+ *   2. nginx — ensures the core_path map entry + domain→core map + per-domain
+ *      vhost for every brand domain (`cp_domains` owner_type='brand').
+ *   3. DNS (opt-in, --dns) — provisions each domain via the DnsProvider and
+ *      writes the achieved routing/SSL state back to `cp_domains`.
+ *   4. Reloads nginx once (validates first).
+ *
+ * Idempotent by construction: brand.json is compared semantically (no rewrite
+ * if unchanged), nginx map inserts skip-if-present, vhost render is
+ * content-stable. Running twice = a clean "unchanged" run. Drift (a hand-
+ * edited node, a wiped nginx map) is repaired from the control-plane — the
+ * disaster-recovery property the plan calls out (K0).
+ */
+import { Command } from 'commander';
+import { type HostConfig } from '../../lib/hosts.js';
+interface BrandRow {
+    readonly id: string;
+    readonly slug: string;
+    readonly title: string;
+    readonly logo_url: string | null;
+    readonly favicon_url: string | null;
+    readonly theme: Record<string, unknown> | null;
+    readonly data_db_name: string | null;
+}
+export declare function registerBrandCommands(program: Command): void;
+/**
+ * Project tenant state between the control-plane and the brand's data DB (K14
+ * BD2). Two directions, both idempotent:
+ *
+ *   - mirror UP: data DB `tnt_tenants` → `cp_tenants_ref` (the control-plane's
+ *     lightweight tenant mirror; tenants are authored in the data plane, the
+ *     mirror gives the control-plane the brand↔tenant link routing needs).
+ *   - project DOWN: `cp_domains` (owner_type='tenant', this brand's tenants) →
+ *     data DB `tnt_domains`, the cache the runtime reads for host→tenant
+ *     resolution. cp_domains is the authority (K14); tnt_domains is derived.
+ *
+ * Upsert by default. With `prune`, also delete derived tnt_domains rows the
+ * control-plane no longer lists — safe post-BD3 (the tenant write path now
+ * authors cp_domains first, so tnt_domains is purely derived). FK misses
+ * (a cp_domains tenant whose tenant isn't in the data DB) are skipped + warned.
+ */
+export declare function projectTenantState(cfg: HostConfig, brand: BrandRow, summary: string[], prune?: boolean): Promise<void>;
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/brand/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/brand/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGnC,OAAO,EAAiB,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAkBnE,UAAU,QAAQ;IAChB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;IAC9C,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;CACrC;AA+BD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAe5D;AAyMD;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,MAAM,EAAE,EACjB,KAAK,UAAQ,GACZ,OAAO,CAAC,IAAI,CAAC,CA0Ef"}

package/dist/commands/brand/index.js

@@ -0,0 +1,367 @@
+/**
+ * CiCore CLI — `ci brand reconcile` (control-plane → node state)
+ *
+ * The reproducibility keystone (plan B2). The control-plane DB
+ * (`vucore_control`: `cp_brands` + `cp_domains`) is the single source of
+ * truth; this command *renders* the derived node state from it, idempotently:
+ *
+ *   1. brand.json — projects each active brand's identity into
+ *      `cores/<slug>/brand.json` (logo/title/theme) so the Nuxt runtime
+ *      (core-loader → useBrand → VBrandLogo + titleTemplate) reflects it.
+ *      Canonical writer; `BrandService::reconcileBrandJson` (PHP) mirrors it.
+ *   2. nginx — ensures the core_path map entry + domain→core map + per-domain
+ *      vhost for every brand domain (`cp_domains` owner_type='brand').
+ *   3. DNS (opt-in, --dns) — provisions each domain via the DnsProvider and
+ *      writes the achieved routing/SSL state back to `cp_domains`.
+ *   4. Reloads nginx once (validates first).
+ *
+ * Idempotent by construction: brand.json is compared semantically (no rewrite
+ * if unchanged), nginx map inserts skip-if-present, vhost render is
+ * content-stable. Running twice = a clean "unchanged" run. Drift (a hand-
+ * edited node, a wiped nginx map) is repaired from the control-plane — the
+ * disaster-recovery property the plan calls out (K0).
+ */
+import { log, spinner } from '../../lib/logger.js';
+import { isDryRun } from '../../lib/config.js';
+import { getHostConfig } from '../../lib/hosts.js';
+import { dbSelectJson, dbExec } from '../../lib/ops/db.js';
+import { coreReconcileBrandJson } from '../../lib/ops/core.js';
+import { nginxDomainAdd, nginxDomainRemove, nginxEnsureCorePath, nginxListDomainsForCore, nginxReload, nginxRemoveVhost, nginxWriteVhost, } from '../../lib/ops/nginx.js';
+import { createDnsProvider } from '../../lib/ops/dns.js';
+const CONTROL_DB = 'vucore_control';
+/** Brand slugs (and the core dirs they map to) — keep in sync with assertSlug (PHP) + assertCoreName (CLI). */
+const SLUG_RE = /^[a-z][a-z0-9_-]{1,62}$/;
+export function registerBrandCommands(program) {
+    const brand = program.command('brand').description('Brand control-plane operations');
+    brand
+        .command('reconcile')
+        .description('Render node state (brand.json + nginx + DNS) from the control-plane (idempotent)')
+        .option('-h, --host <host>', 'Host alias (cicore | mkt)')
+        .option('--brand <slug>', 'Reconcile only this brand slug (default: all active brands)')
+        .option('--dns', 'Also provision DNS + TLS for each brand domain via the DnsProvider')
+        .option('--fallback-origin <host>', 'CF-for-SaaS fallback origin / owned_zone origin target (with --dns)')
+        .option('--ssl-cert-name <name>', "SSL cert basename for vhosts (default: host's defaultSslCertName)")
+        .option('--prune', 'Delete orphans the control-plane no longer lists (nginx map/vhost + tnt_domains). Destructive — off by default (BD4)')
+        .action(async (options) => {
+        await reconcile(options);
+    });
+}
+async function reconcile(options) {
+    log.title('🔄 Brand reconcile (control-plane → node state)');
+    if (options.host === undefined) {
+        log.error('--host is required (cicore | mkt). Pass --host <alias>.');
+        process.exit(1);
+    }
+    if (options.brand !== undefined && !SLUG_RE.test(options.brand)) {
+        log.error(`Invalid --brand slug '${options.brand}' (a-z, 0-9, -, _; start with a letter).`);
+        process.exit(1);
+    }
+    let cfg;
+    try {
+        cfg = getHostConfig(options.host);
+    }
+    catch (err) {
+        log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+    const dryRun = isDryRun();
+    const sslCertName = options.sslCertName ?? cfg.defaultSslCertName;
+    log.info(`Target host: ${cfg.brandName}`);
+    log.info(`Scope:       ${options.brand ?? 'all active brands'}`);
+    log.info(`DNS:         ${options.dns ? 'provision (--dns)' : 'skip'}`);
+    log.info(`Prune:       ${options.prune ? 'delete orphans (--prune)' : 'keep (upsert-only)'}`);
+    log.info(`Dry run:     ${dryRun ? 'yes' : 'no'}`);
+    log.blank();
+    // ── Read desired state from the control-plane ──────────────────────────
+    const brandFilter = options.brand ? ` AND slug = '${options.brand}'` : '';
+    const brands = await dbSelectJson(cfg, CONTROL_DB, `SELECT id, slug, title, logo_url, favicon_url, theme, data_db_name
+       FROM cp_brands
+      WHERE status = 'active'${brandFilter}
+      ORDER BY slug`);
+    if (brands.length === 0) {
+        log.warn(`No active brands found in ${CONTROL_DB}${options.brand ? ` matching '${options.brand}'` : ''}. Nothing to reconcile.`);
+        return;
+    }
+    const domains = await dbSelectJson(cfg, CONTROL_DB, `SELECT d.domain, d.kind, d.dns_mode, d.ssl_cert_name, b.slug AS brand_slug
+       FROM cp_domains d
+       JOIN cp_brands b ON b.id = d.owner_id
+      WHERE d.owner_type = 'brand'${options.brand ? ` AND b.slug = '${options.brand}'` : ''}
+      ORDER BY d.domain`);
+    log.info(`Desired: ${brands.length} brand(s), ${domains.length} domain(s).`);
+    log.blank();
+    const summary = [];
+    let nginxTouched = false;
+    // ── Render each brand ──────────────────────────────────────────────────
+    for (const b of brands) {
+        const brandDomains = domains.filter(d => d.brand_slug === b.slug);
+        await step(`brand ${b.slug}`, dryRun, async () => {
+            // 1. brand.json projection (semantic-idempotent).
+            const projection = {
+                brand: b.slug,
+                title: b.title,
+                logoUrl: b.logo_url || null,
+                faviconUrl: b.favicon_url || null,
+                theme: b.theme ?? {},
+            };
+            if (dryRun) {
+                log.warn(`[dry-run] reconcile brand.json for ${b.slug} + map ${brandDomains.length} domain(s)`);
+            }
+            else {
+                const bj = await coreReconcileBrandJson(cfg, b.slug, projection);
+                if (!bj.success)
+                    throw new Error(`brand.json: ${bj.stderr}`);
+                summary.push(`✓ ${b.slug}: brand.json ${bj.changed ? 'written' : 'unchanged'}`);
+                // 2. nginx core_path + per-domain map + vhost.
+                const pathRes = await nginxEnsureCorePath(cfg, b.slug);
+                if (!pathRes.success)
+                    throw new Error(`nginx core_path: ${pathRes.stderr}`);
+                for (const d of brandDomains) {
+                    const mapRes = await nginxDomainAdd(cfg, d.domain, b.slug);
+                    if (!mapRes.success)
+                        throw new Error(`nginx map ${d.domain}: ${mapRes.stderr}`);
+                    // Per-domain cert (K14 BD2 fix): the domain's own ssl_cert_name from
+                    // the control-plane, falling back to the host default only when unset.
+                    // Multi-brand hosts carry distinct certs — using the host default for
+                    // every domain would write the wrong cert + break TLS on reload.
+                    const certName = d.ssl_cert_name ?? sslCertName;
+                    const vhostRes = await nginxWriteVhost(cfg, b.slug, d.domain, certName);
+                    if (!vhostRes.success)
+                        throw new Error(`nginx vhost ${d.domain}: ${vhostRes.stderr}`);
+                    nginxTouched = true;
+                    summary.push(`✓ ${b.slug}: nginx ${d.domain} → ${b.slug} (ssl=${certName})`);
+                }
+                // 2b. Tenant projection (K14 BD2/BD4): mirror tenants up + project
+                // tenant domains down into the brand's data DB tnt_domains. With
+                // --prune, also delete derived tnt_domains rows the control-plane no
+                // longer lists (safe post-BD3: the runtime no longer authors them).
+                await projectTenantState(cfg, b, summary, options.prune === true);
+            }
+            // 2c. Prune nginx orphans (BD4, opt-in): map/vhost the control-plane no
+            // longer lists. Honors dry-run (logs only). Runs outside the else so a
+            // dry-run still reports what it would remove.
+            if (options.prune) {
+                const pruned = await pruneBrandNginxOrphans(cfg, b.slug, brandDomains, dryRun, summary);
+                if (pruned)
+                    nginxTouched = true;
+            }
+            // 3. DNS (opt-in).
+            if (options.dns && !dryRun) {
+                await provisionBrandDns(cfg, b.slug, brandDomains, options, summary);
+            }
+        });
+    }
+    // 4. Reload nginx once.
+    if (nginxTouched && !dryRun) {
+        await step('reload nginx (validates first)', dryRun, async () => {
+            const res = await nginxReload(cfg);
+            if (!res.success)
+                throw new Error(`nginx reload: ${res.stderr}`);
+            summary.push('✓ nginx reloaded');
+        });
+    }
+    log.blank();
+    log.title('✨ Reconcile complete');
+    for (const line of summary)
+        log.info(line);
+    if (summary.every(l => l.includes('unchanged')) && nginxTouched === false) {
+        log.info('(no drift — node already matches the control-plane)');
+    }
+}
+/**
+ * Prune nginx routing the control-plane no longer lists for this brand (BD4).
+ * Reads the domains nginx currently maps to the brand's core and removes any
+ * that aren't a desired cp_domains entry (nor the api.<domain> mirror of one):
+ * the DOMAIN_CORE_MAP line plus, for a primary domain, its vhost file. The
+ * caller reloads nginx once after all brands. Returns true if anything changed.
+ *
+ * Scope-safe: only touches entries pointing at THIS brand's core, so other
+ * brands/cores are never affected. A domain mapped here but absent from the
+ * control-plane is exactly the drift reconcile is meant to repair (K0) — but
+ * because removal takes live routing offline it's gated behind --prune.
+ */
+async function pruneBrandNginxOrphans(cfg, slug, brandDomains, dryRun, summary) {
+    const mapped = await nginxListDomainsForCore(cfg, slug);
+    // Keep desired domains + their api.<domain> mirrors (nginxDomainAdd pairs them).
+    const kept = new Set();
+    for (const d of brandDomains) {
+        kept.add(d.domain);
+        kept.add(`api.${d.domain}`);
+    }
+    const orphans = mapped.filter(d => !kept.has(d));
+    if (orphans.length === 0)
+        return false;
+    let changed = false;
+    for (const orphan of orphans) {
+        if (dryRun) {
+            log.warn(`[dry-run] prune nginx orphan ${orphan} (→ ${slug})${orphan.startsWith('api.') ? '' : ' + vhost'}`);
+            summary.push(`✓ ${slug}: [dry-run] would prune ${orphan}`);
+            continue;
+        }
+        const unmap = await nginxDomainRemove(cfg, orphan);
+        if (!unmap.success) {
+            log.warn(`[prune] ${slug}: could not unmap ${orphan}: ${unmap.stderr.trim()}`);
+            continue;
+        }
+        // Only primary domains carry a vhost file; api.<domain> is a map entry only.
+        if (!orphan.startsWith('api.')) {
+            const rmVhost = await nginxRemoveVhost(cfg, orphan);
+            if (!rmVhost.success)
+                log.warn(`[prune] ${slug}: could not remove vhost for ${orphan}: ${rmVhost.stderr.trim()}`);
+        }
+        changed = true;
+        summary.push(`✓ ${slug}: pruned orphan ${orphan}`);
+    }
+    return changed;
+}
+/**
+ * Project tenant state between the control-plane and the brand's data DB (K14
+ * BD2). Two directions, both idempotent:
+ *
+ *   - mirror UP: data DB `tnt_tenants` → `cp_tenants_ref` (the control-plane's
+ *     lightweight tenant mirror; tenants are authored in the data plane, the
+ *     mirror gives the control-plane the brand↔tenant link routing needs).
+ *   - project DOWN: `cp_domains` (owner_type='tenant', this brand's tenants) →
+ *     data DB `tnt_domains`, the cache the runtime reads for host→tenant
+ *     resolution. cp_domains is the authority (K14); tnt_domains is derived.
+ *
+ * Upsert by default. With `prune`, also delete derived tnt_domains rows the
+ * control-plane no longer lists — safe post-BD3 (the tenant write path now
+ * authors cp_domains first, so tnt_domains is purely derived). FK misses
+ * (a cp_domains tenant whose tenant isn't in the data DB) are skipped + warned.
+ */
+export async function projectTenantState(cfg, brand, summary, prune = false) {
+    if (!brand.data_db_name) {
+        summary.push(`· ${brand.slug}: data_db yok — tenant projeksiyon atlandı`);
+        return;
+    }
+    const dataDb = brand.data_db_name;
+    // ── mirror UP: tnt_tenants → cp_tenants_ref ──────────────────────────
+    const tenants = await dbSelectJson(cfg, dataDb, `SELECT id, slug FROM tnt_tenants`);
+    for (const t of tenants) {
+        await dbExec(cfg, CONTROL_DB, `INSERT INTO cp_tenants_ref (brand_id, data_tenant_id, slug)
+       VALUES ('${brand.id}', '${t.id}', '${sqlLit(t.slug)}')
+       ON CONFLICT (brand_id, slug) DO UPDATE SET data_tenant_id = EXCLUDED.data_tenant_id`);
+    }
+    if (tenants.length > 0)
+        summary.push(`✓ ${brand.slug}: ${tenants.length} tenant aynalandı (cp_tenants_ref)`);
+    // ── project DOWN: cp_domains(tenant) → tnt_domains ───────────────────
+    const tdomains = await dbSelectJson(cfg, CONTROL_DB, `SELECT d.domain, d.kind, d.routing_status, r.data_tenant_id
+       FROM cp_domains d
+       JOIN cp_tenants_ref r ON r.data_tenant_id = d.owner_id
+      WHERE d.owner_type = 'tenant' AND r.brand_id = '${brand.id}'`);
+    let projected = 0;
+    for (const d of tdomains) {
+        const type = d.kind === 'subdomain' || d.kind === 'tenant_subdomain' ? 'subdomain' : 'domain';
+        const status = d.routing_status === 'active' ? 'active' : 'pending';
+        // Manual upsert by (tenant_id, domain) — no assumption about a unique
+        // constraint on tnt_domains. UPDATE then conditional INSERT.
+        const sql = `UPDATE tnt_domains SET status='${status}', type='${type}', updated_at=now() ` +
+            `WHERE tenant_id='${d.data_tenant_id}' AND domain='${sqlLit(d.domain)}';\n` +
+            `INSERT INTO tnt_domains (tenant_id, domain, status, type, created_at, updated_at) ` +
+            `SELECT '${d.data_tenant_id}','${sqlLit(d.domain)}','${status}','${type}',now(),now() ` +
+            `WHERE NOT EXISTS (SELECT 1 FROM tnt_domains WHERE tenant_id='${d.data_tenant_id}' AND domain='${sqlLit(d.domain)}');`;
+        const res = await dbExec(cfg, dataDb, sql);
+        if (res.success)
+            projected++;
+        else
+            log.warn(`[reconcile] ${brand.slug}: tnt_domains projeksiyon atlandı (${d.domain}): ${res.stderr.trim()}`);
+    }
+    if (projected > 0)
+        summary.push(`✓ ${brand.slug}: ${projected} tenant domain projekte edildi (tnt_domains)`);
+    // ── prune DOWN: drop derived tnt_domains rows not in cp_domains (BD4) ──
+    if (prune) {
+        // Desired domains per tenant from the authority (cp_domains owner=tenant).
+        const desired = new Map();
+        for (const d of tdomains) {
+            const set = desired.get(d.data_tenant_id) ?? new Set();
+            set.add(d.domain.toLowerCase());
+            desired.set(d.data_tenant_id, set);
+        }
+        let pruned = 0;
+        // Only prune tenants the control-plane knows (this brand's mirrored tenants),
+        // never touching data DBs/tenants outside the authority's view.
+        for (const t of tenants) {
+            const keep = desired.get(t.id);
+            const notIn = keep && keep.size > 0
+                ? ` AND lower(domain) NOT IN (${[...keep].map(d => `'${sqlLit(d)}'`).join(',')})`
+                : ''; // no desired domains for this tenant → all its tnt_domains are orphans
+            const res = await dbExec(cfg, dataDb, `DELETE FROM tnt_domains WHERE tenant_id='${t.id}'${notIn};`);
+            if (res.success) {
+                // dbExec doesn't surface rowcount here; count the operation, not rows.
+                pruned++;
+            }
+            else {
+                log.warn(`[reconcile] ${brand.slug}: tnt_domains prune atlandı (tenant ${t.slug}): ${res.stderr.trim()}`);
+            }
+        }
+        if (pruned > 0)
+            summary.push(`✓ ${brand.slug}: tnt_domains orphan-prune uygulandı (${pruned} tenant)`);
+    }
+}
+/**
+ * Provision DNS for a brand's domains via the DnsProvider and write the
+ * achieved routing/SSL state back to `cp_domains`. Each domain's mode is the
+ * control-plane `dns_mode`, falling back to auto-detection. A `pending` SSL
+ * (async DV issuance) is recorded as-is, not treated as a failure.
+ */
+async function provisionBrandDns(cfg, slug, brandDomains, options, summary) {
+    const provider = createDnsProvider(cfg);
+    const originTarget = options.fallbackOrigin ?? '';
+    for (const d of brandDomains) {
+        // Map the control-plane dns_mode → DnsProvider mode:
+        //   custom_hostname → custom_hostname (BYO domain, CF for SaaS)
+        //   full_zone / subdomain → owned_zone (a zone/subdomain we manage)
+        // detectMode is the fallback only if the column is somehow unset.
+        const mode = d.dns_mode === 'custom_hostname'
+            ? 'custom_hostname'
+            : d.dns_mode === 'full_zone' || d.dns_mode === 'subdomain'
+                ? 'owned_zone'
+                : await provider.detectMode(d.domain);
+        if (mode === 'owned_zone' && !originTarget) {
+            log.warn(`[dns] ${d.domain}: owned_zone needs --fallback-origin (CNAME target) — skipping DNS for this domain.`);
+            continue;
+        }
+        const state = await provider.ensureHost({ hostname: d.domain, mode, originTarget });
+        if (!state.success) {
+            await writeDomainStatus(cfg, d.domain, 'error', 'error');
+            throw new Error(`DNS provision failed for ${d.domain}: ${state.errorMessage}`);
+        }
+        await writeDomainStatus(cfg, d.domain, state.routingStatus, state.sslStatus, state.customHostnameId, state.cfZoneId);
+        const sslNote = state.sslStatus === 'active' ? 'ssl active' : 'ssl pending';
+        summary.push(`✓ ${slug}: DNS ${d.domain} [${mode}] routing=${state.routingStatus}, ${sslNote}`);
+    }
+}
+/** Write achieved DNS state back to cp_domains. Values are validated/enum — safe to interpolate. */
+async function writeDomainStatus(cfg, domain, routing, ssl, customHostnameId, cfZoneId) {
+    const setCh = customHostnameId ? `, cf_custom_hostname_id = '${sqlLit(customHostnameId)}'` : '';
+    const setZone = cfZoneId ? `, cf_zone_id = '${sqlLit(cfZoneId)}'` : '';
+    const sql = `UPDATE cp_domains SET routing_status = '${routing}', ssl_status = '${ssl}'${setCh}${setZone}, updated_at = now() ` +
+        `WHERE domain = '${sqlLit(domain)}';`;
+    const res = await dbExec(cfg, CONTROL_DB, sql);
+    if (!res.success)
+        log.warn(`[dns] could not persist status for ${domain}: ${res.stderr.trim()}`);
+}
+/** Escape single quotes for a SQL string literal (defence-in-depth; inputs already validated). */
+function sqlLit(s) {
+    return s.replace(/'/g, "''");
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Step runner (consistent log + dry-run handling)
+// ─────────────────────────────────────────────────────────────────────────
+async function step(label, dryRun, body) {
+    if (dryRun) {
+        await body(); // dry-run bodies only log; no spinner noise
+        return;
+    }
+    const sp = spinner(label).start();
+    try {
+        await body();
+        sp.succeed(label);
+    }
+    catch (err) {
+        sp.fail(label);
+        log.error(err instanceof Error ? err.message : String(err));
+        process.exit(1);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/brand/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/brand/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,aAAa,EAAmB,MAAM,oBAAoB,CAAA;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAwB,MAAM,uBAAuB,CAAA;AACpF,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,uBAAuB,EACvB,WAAW,EACX,gBAAgB,EAChB,eAAe,GAChB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,iBAAiB,EAAgB,MAAM,sBAAsB,CAAA;AAEtE,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,+GAA+G;AAC/G,MAAM,OAAO,GAAG,yBAAyB,CAAA;AAyCzC,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,CAAC,gCAAgC,CAAC,CAAA;IAEpF,KAAK;SACF,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kFAAkF,CAAC;SAC/F,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,gBAAgB,EAAE,6DAA6D,CAAC;SACvF,MAAM,CAAC,OAAO,EAAE,oEAAoE,CAAC;SACrF,MAAM,CAAC,0BAA0B,EAAE,qEAAqE,CAAC;SACzG,MAAM,CAAC,wBAAwB,EAAE,mEAAmE,CAAC;SACrG,MAAM,CAAC,SAAS,EAAE,sHAAsH,CAAC;SACzI,MAAM,CAAC,KAAK,EAAE,OAAyB,EAAE,EAAE;QAC1C,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACN,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,OAAyB;IAChD,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAA;IAE5D,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,GAAG,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAA;QACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,yBAAyB,OAAO,CAAC,KAAK,0CAA0C,CAAC,CAAA;QAC3F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,IAAI,GAAe,CAAA;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAA;IACzB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,GAAG,CAAC,kBAAkB,CAAA;IACjE,GAAG,CAAC,IAAI,CAAC,gBAAgB,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACzC,GAAG,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,KAAK,IAAI,mBAAmB,EAAE,CAAC,CAAA;IAChE,GAAG,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACtE,GAAG,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAAA;IAC7F,GAAG,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IACjD,GAAG,CAAC,KAAK,EAAE,CAAA;IAEX,0EAA0E;IAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,YAAY,CAC/B,GAAG,EACH,UAAU,EACV;;+BAE2B,WAAW;oBACtB,CACjB,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,6BAA6B,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,cAAc,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAA;QAChI,OAAM;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,GAAG,EACH,UAAU,EACV;;;oCAGgC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE;wBACnE,CACrB,CAAA;IAED,GAAG,CAAC,IAAI,CAAC,YAAY,MAAM,CAAC,MAAM,cAAc,OAAO,CAAC,MAAM,aAAa,CAAC,CAAA;IAC5E,GAAG,CAAC,KAAK,EAAE,CAAA;IAEX,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,IAAI,YAAY,GAAG,KAAK,CAAA;IAExB,0EAA0E;IAC1E,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,IAAI,CAAC,CAAA;QACjE,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YAC/C,kDAAkD;YAClD,MAAM,UAAU,GAAoB;gBAClC,KAAK,EAAE,CAAC,CAAC,IAAI;gBACb,KAAK,EAAE,CAAC,CAAC,KAAK;gBACd,OAAO,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;gBAC3B,UAAU,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;gBACjC,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE;aACrB,CAAA;YACD,IAAI,MAAM,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAC,IAAI,UAAU,YAAY,CAAC,MAAM,YAAY,CAAC,CAAA;YACjG,CAAC;iBAAM,CAAC;gBACN,MAAM,EAAE,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;gBAChE,IAAI,CAAC,EAAE,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,CAAC,CAAA;gBAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,gBAAgB,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAA;gBAE/E,+CAA+C;gBAC/C,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;gBACtD,IAAI,CAAC,OAAO,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAA;gBAE3E,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;oBAC7B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;oBAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,aAAa,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;oBAC/E,qEAAqE;oBACrE,uEAAuE;oBACvE,sEAAsE;oBACtE,iEAAiE;oBACjE,MAAM,QAAQ,GAAG,CAAC,CAAC,aAAa,IAAI,WAAW,CAAA;oBAC/C,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;oBACvE,IAAI,CAAC,QAAQ,CAAC,OAAO;wBAAE,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;oBACrF,YAAY,GAAG,IAAI,CAAA;oBACnB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,MAAM,MAAM,CAAC,CAAC,IAAI,SAAS,QAAQ,GAAG,CAAC,CAAA;gBAC9E,CAAC;gBAED,mEAAmE;gBACnE,iEAAiE;gBACjE,qEAAqE;gBACrE,oEAAoE;gBACpE,MAAM,kBAAkB,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,CAAA;YACnE,CAAC;YAED,wEAAwE;YACxE,uEAAuE;YACvE,8CAA8C;YAC9C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;gBACvF,IAAI,MAAM;oBAAE,YAAY,GAAG,IAAI,CAAA;YACjC,CAAC;YAED,mBAAmB;YACnB,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;gBAC3B,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACtE,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,gCAAgC,EAAE,MAAM,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;YAChE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;QAClC,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,GAAG,CAAC,KAAK,EAAE,CAAA;IACX,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QAC1E,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAA;IACjE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,KAAK,UAAU,sBAAsB,CACnC,GAAe,EACf,IAAY,EACZ,YAAkC,EAClC,MAAe,EACf,OAAiB;IAEjB,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;IACvD,iFAAiF;IACjF,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAClB,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEtC,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,gCAAgC,MAAM,OAAO,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAA;YAC5G,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,2BAA2B,MAAM,EAAE,CAAC,CAAA;YAC1D,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,qBAAqB,MAAM,KAAK,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC9E,SAAQ;QACV,CAAC;QACD,6EAA6E;QAC7E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YACnD,IAAI,CAAC,OAAO,CAAC,OAAO;gBAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,gCAAgC,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACnH,CAAC;QACD,OAAO,GAAG,IAAI,CAAA;QACd,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,mBAAmB,MAAM,EAAE,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAaD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAe,EACf,KAAe,EACf,OAAiB,EACjB,KAAK,GAAG,KAAK;IAEb,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,4CAA4C,CAAC,CAAA;QACzE,OAAM;IACR,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY,CAAA;IAEjC,wEAAwE;IACxE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAY,GAAG,EAAE,MAAM,EAAE,kCAAkC,CAAC,CAAA;IAC9F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,CACV,GAAG,EACH,UAAU,EACV;kBACY,KAAK,CAAC,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;2FACiC,CACtF,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,oCAAoC,CAAC,CAAA;IAE5G,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,YAAY,CACjC,GAAG,EACH,UAAU,EACV;;;wDAGoD,KAAK,CAAC,EAAE,GAAG,CAChE,CAAA;IACD,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,WAAW,IAAI,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC7F,MAAM,MAAM,GAAG,CAAC,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAA;QACnE,sEAAsE;QACtE,6DAA6D;QAC7D,MAAM,GAAG,GACP,kCAAkC,MAAM,YAAY,IAAI,sBAAsB;YAC9E,oBAAoB,CAAC,CAAC,cAAc,iBAAiB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM;YAC3E,oFAAoF;YACpF,WAAW,CAAC,CAAC,cAAc,MAAM,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,MAAM,MAAM,IAAI,gBAAgB;YACvF,gEAAgE,CAAC,CAAC,cAAc,iBAAiB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAA;QACxH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,CAAA;QAC1C,IAAI,GAAG,CAAC,OAAO;YAAE,SAAS,EAAE,CAAA;;YACvB,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACjH,CAAC;IACD,IAAI,SAAS,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,SAAS,8CAA8C,CAAC,CAAA;IAE5G,0EAA0E;IAC1E,IAAI,KAAK,EAAE,CAAC;QACV,2EAA2E;QAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAA;QAC9C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,IAAI,GAAG,EAAU,CAAA;YAC9D,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;YAC/B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAA;QACpC,CAAC;QACD,IAAI,MAAM,GAAG,CAAC,CAAA;QACd,8EAA8E;QAC9E,gEAAgE;QAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YAC9B,MAAM,KAAK,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC;gBACjC,CAAC,CAAC,8BAA8B,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;gBACjF,CAAC,CAAC,EAAE,CAAA,CAAC,uEAAuE;YAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,4CAA4C,CAAC,CAAC,EAAE,IAAI,KAAK,GAAG,CAAC,CAAA;YACnG,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;gBAChB,uEAAuE;gBACvE,MAAM,EAAE,CAAA;YACV,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,IAAI,uCAAuC,CAAC,CAAC,IAAI,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;YAC3G,CAAC;QACH,CAAC;QACD,IAAI,MAAM,GAAG,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,yCAAyC,MAAM,UAAU,CAAC,CAAA;IACxG,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,IAAY,EACZ,YAAkC,EAClC,OAAyB,EACzB,OAAiB;IAEjB,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAA;IACvC,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAA;IAEjD,KAAK,MAAM,CAAC,IAAI,YAAY,EAAE,CAAC;QAC7B,qDAAqD;QACrD,gEAAgE;QAChE,oEAAoE;QACpE,kEAAkE;QAClE,MAAM,IAAI,GACR,CAAC,CAAC,QAAQ,KAAK,iBAAiB;YAC9B,CAAC,CAAC,iBAAiB;YACnB,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,QAAQ,KAAK,WAAW;gBACxD,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QAE3C,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,qFAAqF,CAAC,CAAA;YAChH,SAAQ;QACV,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAA;QACnF,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;YACxD,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,EAAE,CAAC,CAAA;QAChF,CAAC;QACD,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAA;QACpH,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAA;QAC3E,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC,CAAC,MAAM,KAAK,IAAI,aAAa,KAAK,CAAC,aAAa,KAAK,OAAO,EAAE,CAAC,CAAA;IACjG,CAAC;AACH,CAAC;AAED,oGAAoG;AACpG,KAAK,UAAU,iBAAiB,CAC9B,GAAe,EACf,MAAc,EACd,OAAe,EACf,GAAW,EACX,gBAAyB,EACzB,QAAiB;IAEjB,MAAM,KAAK,GAAG,gBAAgB,CAAC,CAAC,CAAC,8BAA8B,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/F,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAA;IACtE,MAAM,GAAG,GACP,2CAA2C,OAAO,oBAAoB,GAAG,IAAI,KAAK,GAAG,OAAO,uBAAuB;QACnH,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAA;IACvC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IAC9C,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,sCAAsC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAClG,CAAC;AAED,kGAAkG;AAClG,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;AAC9B,CAAC;AAED,4EAA4E;AAC5E,kDAAkD;AAClD,4EAA4E;AAE5E,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAe,EAAE,IAAyB;IAC3E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,EAAE,CAAA,CAAC,4CAA4C;QACzD,OAAM;IACR,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAA;IACjC,IAAI,CAAC;QACH,MAAM,IAAI,EAAE,CAAA;QACZ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACd,GAAG,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/commands/build/index.d.ts

@@ -0,0 +1,53 @@
+/**
+ * CiCore CLI — Build commands (host-aware)
+ *
+ * Three subcommands, one for each core image plus addons:
+ *
+ *   - `vu build nuxt --host <h> [--deploy]`  build Nuxt → push → upload UI → deploy
+ *   - `vu build php  --host <h> [--deploy]`  build PHP  → push → deploy
+ *   - `vu build addon <name> --host <h>`     vite build → upload → install backend → deploy
+ *
+ * Everything host-specific (registry namespace, CDN endpoint, server paths,
+ * container names, ssh target, CF zone) comes from {@link getHostConfig};
+ * there is no global CONFIG sabit any more, no hardcoded URL, no hardcoded
+ * `/home/cores/...`. Add a host to STATIC_TOPOLOGY and the same commands
+ * deploy to it.
+ *
+ * Heavy lifting (image build/push/pull/retag, compose ops, CDN clean/upload,
+ * nginx reload, CF purge) is delegated to the `ops/` primitives written in
+ * step 2. This file is mostly orchestration + CLI plumbing + the things
+ * still local to the Mac build host (Tailwind safelist, Vite build, manifest
+ * generation, Asset hashing).
+ */
+import { Command } from 'commander';
+export interface NuxtBuildOptions {
+    readonly skipCdn?: boolean;
+    readonly skipPush?: boolean;
+    readonly skipBuild?: boolean;
+    readonly skipServer?: boolean;
+    readonly skipSafelist?: boolean;
+    readonly host?: string;
+    readonly core?: string;
+    readonly deploy?: boolean;
+    readonly dryRun?: boolean;
+}
+export interface PhpBuildOptions {
+    readonly skipPush?: boolean;
+    readonly skipServer?: boolean;
+    readonly host?: string;
+    readonly core?: string;
+    readonly deploy?: boolean;
+    readonly dryRun?: boolean;
+}
+export interface AddonBuildOptions {
+    readonly core?: string;
+    readonly skipCdn?: boolean;
+    readonly skipServer?: boolean;
+    readonly host?: string;
+    readonly dryRun?: boolean;
+}
+export declare function registerBuildCommands(program: Command): void;
+export declare function buildNuxt(options: NuxtBuildOptions): Promise<void>;
+export declare function buildPHP(options: PhpBuildOptions): Promise<void>;
+export declare function buildAddon(addonName: string, options: AddonBuildOptions): Promise<void>;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/build/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/build/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA8BnC,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;IAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA2C5D;AAMD,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAqDxE;AA8HD,wBAAsB,QAAQ,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAiCtE;AAkDD,wBAAsB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+D7F"}