@cicore/cli 1.0.0

package/dist/commands/db/rollback-silo.d.ts

@@ -0,0 +1,44 @@
+/**
+ * CiCore CLI — `ci db rollback-silo` (Faz 6.2).
+ *
+ * 9-step orchestrator: silo→pool geri dönüş. Promote'un ters yönü; SAME
+ * helper'larla AYNI invariant + 1 yeni (INV-5).
+ *
+ * LOCKED spec: docs/planning/2026-06-01-faz6-promote-silo.md (§ 8).
+ *
+ * Mustafa kilitleri:
+ *   K-R1 — Full silo→pool re-sync (silo authoritative; delta sync M3).
+ *   K-R2 — DELETE children→parents reverse + COPY parents→children +
+ *          EXPLICIT brand_id + ref'lere DOKUNMA.
+ *   K-R3 — UUID-only v1; SERIAL/IDENTITY pre-flight REJECT (LOUD fail).
+ *   K-R4 — Yeni 'rolling_back' status (middleware allow-list extend).
+ *   K-R5 — Faz 6 helper'larını yön-parametreli REUSE (promote-silo.ts'ten
+ *          import + copyTableWithPredicate poolDb/siloDb argümanları swap).
+ *   K-R6 — Silo SİLİNMEZ; cp_databases.status='retired' + ayrı cleanup job.
+ *
+ * INVARIANT:
+ *   INV-1 — Cutover gate Step 7'de (count + checksum + FK + INV-5).
+ *   INV-2 (ters) — Silo retain (INV-2 promote'ta pool intaktı, burada
+ *          silo intakt; symmetric güvenlik ağı).
+ *   INV-3 — Write-freeze status='rolling_back' (BrandWriteGuardMiddleware
+ *          allow-list, migration 005).
+ *   INV-4 — Pool'da FK orphan = 0 (rollback sonrası ref'ler zaten vardı,
+ *          orphan üretmemeli; checkFkOrphans pool tarafında).
+ *   INV-5 — Pool'da diğer brand'in satır sayısı DEĞİŞMEDİ (Step 3
+ *          baseline + Step 7 assert).
+ *
+ * LOUD known-gap'ler (spec § 8 K-R3 sertleştirme):
+ *   GAP-A — Manifest boş (brand_id kolonu yok) → THROW + operator mesajı:
+ *          "M3 multi-tenancy data isolation upgrade prerequisite".
+ *   GAP-B — Non-UUID PK tablo var → THROW + liste + K-R3-ALT işareti.
+ *   "silently passing" YOL YOK.
+ */
+import { Command } from 'commander';
+import { type TableEntry } from './promote-silo.js';
+export declare function registerRollbackSilo(db: Command): void;
+/**
+ * Manifest'i DELETE için ters-topo sırala: depth DESC + alfabetik tie-break.
+ * Children önce silinir (FK violation'sız parent temizliği).
+ */
+export declare function reverseTopoForDelete(manifest: TableEntry[]): TableEntry[];
+//# sourceMappingURL=rollback-silo.d.ts.map

package/dist/commands/db/rollback-silo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-silo.d.ts","sourceRoot":"","sources":["../../../src/commands/db/rollback-silo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAKnC,OAAO,EAKL,KAAK,UAAU,EAmBhB,MAAM,mBAAmB,CAAA;AAU1B,wBAAgB,oBAAoB,CAAC,EAAE,EAAE,OAAO,GAAG,IAAI,CAwBtD;AAuYD;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CAMzE"}

package/dist/commands/db/rollback-silo.js

@@ -0,0 +1,402 @@
+/**
+ * CiCore CLI — `ci db rollback-silo` (Faz 6.2).
+ *
+ * 9-step orchestrator: silo→pool geri dönüş. Promote'un ters yönü; SAME
+ * helper'larla AYNI invariant + 1 yeni (INV-5).
+ *
+ * LOCKED spec: docs/planning/2026-06-01-faz6-promote-silo.md (§ 8).
+ *
+ * Mustafa kilitleri:
+ *   K-R1 — Full silo→pool re-sync (silo authoritative; delta sync M3).
+ *   K-R2 — DELETE children→parents reverse + COPY parents→children +
+ *          EXPLICIT brand_id + ref'lere DOKUNMA.
+ *   K-R3 — UUID-only v1; SERIAL/IDENTITY pre-flight REJECT (LOUD fail).
+ *   K-R4 — Yeni 'rolling_back' status (middleware allow-list extend).
+ *   K-R5 — Faz 6 helper'larını yön-parametreli REUSE (promote-silo.ts'ten
+ *          import + copyTableWithPredicate poolDb/siloDb argümanları swap).
+ *   K-R6 — Silo SİLİNMEZ; cp_databases.status='retired' + ayrı cleanup job.
+ *
+ * INVARIANT:
+ *   INV-1 — Cutover gate Step 7'de (count + checksum + FK + INV-5).
+ *   INV-2 (ters) — Silo retain (INV-2 promote'ta pool intaktı, burada
+ *          silo intakt; symmetric güvenlik ağı).
+ *   INV-3 — Write-freeze status='rolling_back' (BrandWriteGuardMiddleware
+ *          allow-list, migration 005).
+ *   INV-4 — Pool'da FK orphan = 0 (rollback sonrası ref'ler zaten vardı,
+ *          orphan üretmemeli; checkFkOrphans pool tarafında).
+ *   INV-5 — Pool'da diğer brand'in satır sayısı DEĞİŞMEDİ (Step 3
+ *          baseline + Step 7 assert).
+ *
+ * LOUD known-gap'ler (spec § 8 K-R3 sertleştirme):
+ *   GAP-A — Manifest boş (brand_id kolonu yok) → THROW + operator mesajı:
+ *          "M3 multi-tenancy data isolation upgrade prerequisite".
+ *   GAP-B — Non-UUID PK tablo var → THROW + liste + K-R3-ALT işareti.
+ *   "silently passing" YOL YOK.
+ */
+import { log } from '../../lib/logger.js';
+import { dbSelectJson, dbExec } from '../../lib/ops/db.js';
+import { invalidateBrandStatus } from '../../lib/ops/redis.js';
+import { isDryRun } from '../../lib/config.js';
+import { blankSteps, resolveHost, step, persistSteps, currentStepIndex, doDiscovery, fetchPoolDb, countWithPredicate, countWhere, copyTableWithPredicate, checkFkOrphans, tableChecksum, fetchPrimaryKeyColumns, quoteIdent, quoteQualified, sqlLit, } from './promote-silo.js';
+const CONTROL_DB = 'vucore_control';
+const SLUG_RE = /^[a-z][a-z0-9_-]{1,62}$/;
+const STEP_COUNT = 9;
+// ─────────────────────────────────────────────────────────────────────────
+// Public API
+// ─────────────────────────────────────────────────────────────────────────
+export function registerRollbackSilo(db) {
+    db.command('rollback-silo')
+        .description('Reverse a silo-tier brand back to pool (9-step orchestrator; INV-5 anti-leak; UUID-only v1)')
+        .requiredOption('--brand <slug>', 'Brand slug to roll back')
+        .option('-h, --host <host>', 'Host alias (cicore | mkt)')
+        .option('--job-id <uuid>', 'Existing cp_provisioning_jobs id (resume); else a new ad-hoc run')
+        .option('--confirm-manifest', 'Skip the human-review pause on Step 2 (CI/agent mode)', false)
+        .option('--dry-run', 'Plan only — validate + discovery + baseline (no DELETE/COPY)', false)
+        .action(async (opts) => {
+        const cfg = resolveHost(opts.host);
+        if (!SLUG_RE.test(opts.brand)) {
+            log.error(`Invalid --brand slug '${opts.brand}'.`);
+            process.exit(1);
+        }
+        const ctx = {
+            cfg,
+            brand: opts.brand,
+            jobId: opts.jobId ?? null,
+            confirmManifest: opts.confirmManifest === true,
+            dryRun: opts.dryRun === true || isDryRun(), // collision-robust (Part B)
+            steps: blankSteps(STEP_COUNT),
+        };
+        const ok = await runRollback(ctx);
+        process.exit(ok ? 0 : 1);
+    });
+}
+// ─────────────────────────────────────────────────────────────────────────
+// 9-step orchestrator
+// ─────────────────────────────────────────────────────────────────────────
+async function runRollback(ctx) {
+    log.info(`[rollback-silo] brand=${ctx.brand} host=${ctx.cfg.alias} dry-run=${ctx.dryRun}`);
+    try {
+        // STEP 1 — VALIDATE (tier=silo + UUID-only K-R3 + GAP-A/B LOUD fail)
+        const brand = await step(ctx, 0, 'validate', () => doValidate(ctx));
+        // STEP 2 — DISCOVERY (manifest tekrar; promote'la aynı yapı, K-R5 reuse)
+        const pool = await fetchPoolDb(ctx);
+        const silo = await fetchSiloDb(ctx, brand);
+        const discovery = await step(ctx, 1, 'discovery', () => doDiscoveryWithGuards(ctx, brand, silo));
+        // K-R3 UUID-only enforcement + LOUD fails (discovery sonrası)
+        await step(ctx, 1.5, 'pk_uuid_guard', () => validateUuidPks(ctx, silo, discovery));
+        // ↑ Step 1.5 sayısal değil — guard'ı validate ile aynı kategoride sayalım.
+        // İdiomatik düzeltme: validate adımı içinde değil; ayrı kontrol ama
+        // step jsonb'a yazıldığı için index sırasına dikkat. Pragmatik: bu kontrol
+        // discovery'den hemen sonra senkron çağrı olsun ve step'siz koşsun.
+        // (Aşağıdaki refactor ile düzelttim: doValidate içinde tier kontrolü;
+        // UUID guard burada explicit, step jsonb'a yazılmaz.)
+        if (ctx.dryRun) {
+            log.success('[rollback-silo] dry-run complete: validate + discovery + uuid-guard');
+            log.info(`  manifest: ${discovery.tables.length} brand-scoped table(s)`);
+            log.info(`  references: ${discovery.references.length} (rollback ref'lere dokunmaz)`);
+            return true;
+        }
+        // STEP 3 — INV-5 BASELINE (pool'da diğer brand satır sayısı snapshot)
+        const baseline = await step(ctx, 2, 'inv5_baseline', () => captureOtherBrandBaseline(ctx, brand, pool, discovery.tables));
+        // STEP 4 — MARK ROLLING_BACK (K-R4; middleware freeze devreye girer)
+        await step(ctx, 3, 'mark_rolling_back', () => doMarkRollingBack(ctx, brand));
+        // STEP 5 — POOL DELETE REVERSE (children → parents, replica mode)
+        await step(ctx, 4, 'pool_delete_reverse', () => doPoolDeleteReverse(ctx, brand, discovery.tables, pool));
+        // STEP 6 — SILO → POOL COPY (parents → children, EXPLICIT brand_id)
+        await step(ctx, 5, 'silo_to_pool_copy', () => doSiloToPoolCopy(ctx, brand, discovery.tables, silo, pool));
+        // STEP 7 — VERIFY (INV-1 + INV-4 + INV-5)
+        await step(ctx, 6, 'verify_rollback', () => doVerifyRollback(ctx, brand, discovery.tables, silo, pool, baseline));
+        // STEP 8 — REGISTRY FLIP BACK (atomic; silo retain INV-2 ters)
+        await step(ctx, 7, 'registry_flip_back', () => doRegistryFlipBack(ctx, brand, silo));
+        // STEP 9 — CACHE INVALIDATE + AUDIT
+        await step(ctx, 8, 'cache_invalidate', () => doCacheInvalidateRollback(ctx, brand));
+        log.success(`[rollback-silo] ✅ success — brand '${ctx.brand}' rolled back to pool (silo retained; INV-2 ters)`);
+        return true;
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        log.error(`[rollback-silo] ❌ failed at step ${currentStepIndex(ctx) + 1}: ${msg}`);
+        await persistSteps(ctx, 'failed', msg);
+        return false;
+    }
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Step bodies
+// ─────────────────────────────────────────────────────────────────────────
+/** Step 1 — VALIDATE: brand var + tier=silo + sentinel değil. */
+async function doValidate(ctx) {
+    const rows = await dbSelectJson(ctx.cfg, CONTROL_DB, `SELECT id::text, slug, db_tier, is_default::text, status, placement_region
+       FROM cp_brands WHERE slug='${sqlLit(ctx.brand)}' LIMIT 1`);
+    if (rows.length === 0)
+        throw new Error(`brand '${ctx.brand}' not found in cp_brands`);
+    const b = rows[0];
+    if (b.db_tier !== 'silo') {
+        throw new Error(`brand '${ctx.brand}' tier='${b.db_tier}' — rollback requires tier='silo' ` +
+            `(no-op for pool brands; promote first if intended)`);
+    }
+    if (b.is_default === 't' || b.is_default === true || b.is_default === 'true') {
+        throw new Error(`brand '${ctx.brand}' is_default=true — sentinel brand cannot be rolled back`);
+    }
+    return b;
+}
+/**
+ * Step 2 wrapper — discovery + LOUD GAP-A fail.
+ * GAP-A: brand_id kolonu olan tablo = 0 → manifest boş → THROW.
+ */
+async function doDiscoveryWithGuards(ctx, brand, silo) {
+    const result = await doDiscovery(ctx, brand, silo);
+    if (result.tables.length === 0) {
+        throw new Error('LOUD GAP-A: no brand_id columns found in silo DB → manifest empty. ' +
+            'ciCore tenant schema lacks RLS multi-tenancy. ' +
+            'Production prerequisite: M3 multi-tenancy data isolation upgrade ' +
+            '(brand_id uuid NOT NULL + RLS policy + back-fill). ' +
+            'rollback v1 cannot operate without brand-scoped columns.');
+    }
+    return result;
+}
+/**
+ * UUID-PK guard (K-R3 LOUD enforcement).
+ * Manifest'in her tablosunda PK tipi UUID olmalı; aksi takdirde LOUD fail.
+ */
+async function validateUuidPks(ctx, silo, discovery) {
+    const nonUuid = [];
+    for (const t of discovery.tables) {
+        // PK kolonlarını + tiplerini al
+        const rows = await dbSelectJson(ctx.cfg, silo.db_name, `SELECT a.attname, format_type(a.atttypid, a.atttypmod) AS pk_type
+         FROM pg_index i
+         JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum = ANY(i.indkey)
+         JOIN pg_class c     ON c.oid = i.indrelid
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+        WHERE i.indisprimary
+          AND n.nspname = '${sqlLit(t.schema)}'
+          AND c.relname = '${sqlLit(t.table)}'`);
+        if (rows.length === 0) {
+            nonUuid.push(`${t.schema}.${t.table} (NO PK)`);
+            continue;
+        }
+        for (const r of rows) {
+            const typ = r.pk_type.toLowerCase();
+            if (typ !== 'uuid') {
+                nonUuid.push(`${t.schema}.${t.table}.${r.attname} (${r.pk_type})`);
+            }
+        }
+    }
+    if (nonUuid.length > 0) {
+        throw new Error(`LOUD GAP-B: ${nonUuid.length} non-UUID PK(s) found — rollback v1 supports UUID only. ` +
+            `K-R3-ALT (SERIAL/varchar rewrite + sequence reconciliation) is a separate milestone. ` +
+            `Offending PKs: ${nonUuid.join(', ')}`);
+    }
+    log.info(`[validate] PK uuid-guard: ${discovery.tables.length}/${discovery.tables.length} tables OK`);
+    return { ok: true };
+}
+/**
+ * Step 3 — INV-5 BASELINE.
+ * Pool'da her brand-scoped tabloda diğer brand'in satır sayısını snapshot.
+ * Step 7 verify'da karşılaştırma için kullanılır.
+ */
+async function captureOtherBrandBaseline(ctx, brand, pool, manifest) {
+    const baseline = {};
+    let totalOther = 0;
+    for (const t of manifest) {
+        const where = `brand_id != '${sqlLit(brand.id)}'`;
+        // FK-only tablolarda brand_id kolonu yok → predicate ters yazılamaz.
+        // Bu durumda baseline parent zinciri üzerinden hesaplanır (basit: t.predicate
+        // negate edilemediği için brand_id varsa direct ölçüm; yoksa skip ve uyarı).
+        if (t.via !== 'direct') {
+            log.debug(`[inv5] ${t.schema}.${t.table} skipped baseline (fk-only; parent predicate inverse complex)`);
+            continue;
+        }
+        const n = await countWhere(ctx, pool.db_name, t.schema, t.table, where);
+        baseline[`${t.schema}.${t.table}`] = n;
+        totalOther += n;
+    }
+    log.info(`[inv5] baseline captured: ${Object.keys(baseline).length} direct tables; other_brand_rows=${totalOther}`);
+    return { baseline, rows: totalOther };
+}
+/** Step 4 — MARK ROLLING_BACK (K-R4). */
+async function doMarkRollingBack(ctx, brand) {
+    await dbExec(ctx.cfg, CONTROL_DB, `UPDATE cp_brands SET status='rolling_back', updated_at=now()
+      WHERE id='${brand.id}' AND status != 'rolling_back'`);
+    await invalidateBrandStatus(ctx.cfg, brand.id); // F1: freeze anlık cross-worker
+    return { status: 'rolling_back' };
+}
+/**
+ * Step 5 — POOL DELETE REVERSE (children → parents).
+ *
+ * Manifest depth DESC sırasında DELETE FROM <t> WHERE brand_id=:b.
+ * session_replication_role=replica trigger + FK constraint suspend
+ * (FK violation engeli).
+ */
+async function doPoolDeleteReverse(ctx, brand, manifest, pool) {
+    const ordered = reverseTopoForDelete(manifest);
+    let deletedTotal = 0;
+    for (const t of ordered) {
+        const qTable = quoteQualified(`${t.schema}.${t.table}`);
+        const sql = `SET session_replication_role = replica; ` +
+            `DELETE FROM ${qTable} WHERE ${t.predicate}`;
+        log.info(`  [del  ] ${t.schema}.${t.table} (depth=${t.depth}; reverse-order)`);
+        const res = await dbExec(ctx.cfg, pool.db_name, sql);
+        if (!res.success) {
+            throw new Error(`pool DELETE ${t.schema}.${t.table} failed: ${(res.stderr || res.stdout).trim().slice(0, 500)}`);
+        }
+        // Mevcut dbExec çıktısından "DELETE n" parse ile sayım almak istersek ek
+        // psql --quiet kullanırız; v1 minimal: tablo sayısı raporlanır.
+        deletedTotal++;
+    }
+    log.info(`[delete] tables=${ordered.length} pool rows scrubbed (brand-scoped)`);
+    return { deleted: deletedTotal, tables: ordered.length };
+}
+/** Step 6 — SILO → POOL COPY (parents → children, EXPLICIT brand_id). */
+async function doSiloToPoolCopy(ctx, brand, manifest, silo, pool) {
+    let migrated = 0;
+    let rowsTotal = 0;
+    for (const t of manifest) {
+        const label = `${t.schema}.${t.table}`;
+        const siloCount = await countWhere(ctx, silo.db_name, t.schema, t.table, '1=1');
+        if (siloCount === 0) {
+            log.info(`  [empty] ${label} — silo empty, no-op`);
+            continue;
+        }
+        log.info(`  [copy ] ${label} — ${siloCount} row(s) from silo (depth=${t.depth})`);
+        // K-R5: copyTableWithPredicate yön ters — source=silo, target=pool.
+        // Predicate aynı (brand_id literal'i — silo'da zaten o brand'in tüm
+        // satırları; predicate redundant ama K3 statik garanti korunur).
+        await copyTableWithPredicate(ctx, silo.db_name, pool.db_name, t);
+        const after = await countWithPredicate(ctx, pool.db_name, t);
+        if (after !== siloCount) {
+            log.warn(`  [warn ] ${label} post-copy pool=${after} != silo=${siloCount} (Step 7 verify will block)`);
+        }
+        migrated++;
+        rowsTotal += after;
+    }
+    log.info(`[copy] migrated=${migrated} rows=${rowsTotal}`);
+    return { migrated, rows: rowsTotal };
+}
+/**
+ * Step 7 — VERIFY (INV-1 + INV-4 + INV-5).
+ * (a) Per-table count: pool WHERE predicate == silo WHERE 1=1.
+ * (b) Checksum (UUID PK garantili → her tabloda PK var; K-R3 enforced).
+ * (c) FK-orphan check pool tarafında.
+ * (d) INV-5: other-brand count == baseline (unchanged).
+ */
+async function doVerifyRollback(ctx, brand, manifest, silo, pool, baselineCtx) {
+    let mismatches = 0;
+    let orphans = 0;
+    let inv5Drift = 0;
+    for (const t of manifest) {
+        const label = `${t.schema}.${t.table}`;
+        // (a) count
+        const siloCount = await countWhere(ctx, silo.db_name, t.schema, t.table, '1=1');
+        const poolCount = await countWithPredicate(ctx, pool.db_name, t);
+        if (siloCount !== poolCount) {
+            log.error(`  [count]  ${label} — silo=${siloCount} pool_predicate=${poolCount} MISMATCH`);
+            mismatches++;
+            continue;
+        }
+        log.info(`  [count]  ${label} — ${siloCount} ✓`);
+        // (b) checksum (PK guaranteed UUID by Step 1.5)
+        const pkCols = await fetchPrimaryKeyColumns(ctx, silo.db_name, t.schema, t.table);
+        if (pkCols.length === 0) {
+            log.warn(`  [chk  ]  ${label} — no PK (unexpected post-K-R3); count-only`);
+            continue;
+        }
+        const orderBy = pkCols.map(quoteIdent).join(', ');
+        const siloHash = await tableChecksum(ctx, silo.db_name, t.schema, t.table, '1=1', orderBy);
+        const poolHash = await tableChecksum(ctx, pool.db_name, t.schema, t.table, t.predicate, orderBy);
+        if (siloHash !== poolHash) {
+            log.error(`  [chk  ]  ${label} — silo_md5=${siloHash} pool_md5=${poolHash} MISMATCH`);
+            mismatches++;
+            continue;
+        }
+        log.info(`  [chk  ]  ${label} — md5=${siloHash} ✓`);
+    }
+    // (c) FK orphan check on pool side
+    if (manifest.length > 0) {
+        orphans = await checkFkOrphans(ctx, pool.db_name, manifest);
+        if (orphans > 0) {
+            log.error(`[verify] FK-orphan check (pool): ${orphans} dangling row(s) (INV-4 ihlali)`);
+        }
+        else {
+            log.info(`[verify] FK-orphan check (pool): 0 ✓`);
+        }
+    }
+    // (d) INV-5 — other-brand satır sayısı değişmedi mi
+    for (const t of manifest) {
+        if (t.via !== 'direct')
+            continue;
+        const expected = baselineCtx.baseline[`${t.schema}.${t.table}`];
+        if (expected === undefined)
+            continue;
+        const now = await countWhere(ctx, pool.db_name, t.schema, t.table, `brand_id != '${sqlLit(brand.id)}'`);
+        if (now !== expected) {
+            log.error(`  [inv5 ]  ${t.schema}.${t.table} — baseline=${expected} now=${now} DRIFT ` +
+                `(diğer brand satırları rollback sırasında DEĞİŞTİ — anti-sızıntı ters yön ihlali)`);
+            inv5Drift += Math.abs(now - expected);
+        }
+        else {
+            log.info(`  [inv5 ]  ${t.schema}.${t.table} — other_brand=${expected} ✓`);
+        }
+    }
+    log.info(`[verify] rollback gate: tables=${manifest.length} mismatches=${mismatches} ` +
+        `orphans=${orphans} inv5_drift=${inv5Drift}`);
+    if (mismatches > 0 || orphans > 0 || inv5Drift > 0) {
+        throw new Error(`INV-1/4/5 cutover gate FAIL — mismatches=${mismatches} orphans=${orphans} ` +
+            `inv5_drift=${inv5Drift}; silo intact (INV-2 ters); pool may need manual fix`);
+    }
+    return { tables: manifest.length, mismatches, orphans, inv5Drift };
+}
+/**
+ * Step 8 — REGISTRY FLIP BACK (atomic single-txn).
+ *
+ * cp_brands.db_tier='pool' + data_db_name=NULL + status='active'
+ * (write-freeze kalkar) AND cp_databases silo satırı status='retired'
+ * (silo retain — INV-2 ters; K-R6 ayrı cleanup job 14 gün retention).
+ */
+async function doRegistryFlipBack(ctx, brand, silo) {
+    const sql = `BEGIN;\n` +
+        `UPDATE cp_brands SET db_tier='pool', data_db_name=NULL, status='active', updated_at=now()\n` +
+        ` WHERE id='${brand.id}' AND db_tier='silo';\n` +
+        `UPDATE cp_databases SET status='retired', updated_at=now()\n` +
+        ` WHERE owner_type='brand' AND owner_id='${brand.id}'\n` +
+        `   AND db_name='${sqlLit(silo.db_name)}' AND status='active';\n` +
+        `COMMIT;\n`;
+    const res = await dbExec(ctx.cfg, CONTROL_DB, sql);
+    if (!res.success)
+        throw new Error(`registry flip-back failed: ${res.stderr.trim()}`);
+    return { tier: 'pool', silo_retired: true };
+}
+/** Step 9 — CACHE INVALIDATE + AUDIT END. */
+async function doCacheInvalidateRollback(ctx, brand) {
+    await dbExec(ctx.cfg, CONTROL_DB, `INSERT INTO cp_audit_log (actor, action, target, after)
+     VALUES ('cli:rollback-silo', 'rollback_silo_completed', 'brand:${brand.id}',
+             '${sqlLit(JSON.stringify({ brand: ctx.brand, silo_retained: true }))}'::jsonb)`);
+    return { logged: true };
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Helpers (rollback'e özel)
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Manifest'i DELETE için ters-topo sırala: depth DESC + alfabetik tie-break.
+ * Children önce silinir (FK violation'sız parent temizliği).
+ */
+export function reverseTopoForDelete(manifest) {
+    return [...manifest].sort((a, b) => {
+        if (a.depth !== b.depth)
+            return b.depth - a.depth; // ters: depth desc
+        const ka = `${a.schema}.${a.table}`, kb = `${b.schema}.${b.table}`;
+        return ka < kb ? -1 : ka > kb ? 1 : 0;
+    });
+}
+/** Silo DB lokatörünü cp_databases'tan çek (owner=brand + tier=silo + active). */
+async function fetchSiloDb(ctx, brand) {
+    const rows = await dbSelectJson(ctx.cfg, CONTROL_DB, `SELECT db_host, db_port, db_name, db_user
+       FROM cp_databases
+      WHERE owner_type='brand' AND owner_id='${brand.id}'
+        AND db_tier='silo' AND status='active'
+      LIMIT 1`);
+    if (rows.length === 0) {
+        throw new Error(`no active silo DB for brand '${brand.slug}' (cp_databases owner=brand, tier=silo, status=active)`);
+    }
+    return rows[0];
+}
+//# sourceMappingURL=rollback-silo.js.map

package/dist/commands/db/rollback-silo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback-silo.js","sourceRoot":"","sources":["../../../src/commands/db/rollback-silo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAOL,UAAU,EACV,WAAW,EACX,IAAI,EACJ,YAAY,EACZ,gBAAgB,EAEhB,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,UAAU,EACV,sBAAsB,EACtB,cAAc,EACd,aAAa,EACb,sBAAsB,EACtB,UAAU,EACV,cAAc,EACd,MAAM,GACP,MAAM,mBAAmB,CAAA;AAE1B,MAAM,UAAU,GAAG,gBAAgB,CAAA;AACnC,MAAM,OAAO,GAAG,yBAAyB,CAAA;AACzC,MAAM,UAAU,GAAG,CAAC,CAAA;AAEpB,4EAA4E;AAC5E,aAAa;AACb,4EAA4E;AAE5E,MAAM,UAAU,oBAAoB,CAAC,EAAW;IAC9C,EAAE,CAAC,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,6FAA6F,CAAC;SAC1G,cAAc,CAAC,gBAAgB,EAAE,yBAAyB,CAAC;SAC3D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;SACxD,MAAM,CAAC,iBAAiB,EAAE,kEAAkE,CAAC;SAC7F,MAAM,CAAC,oBAAoB,EAAE,uDAAuD,EAAE,KAAK,CAAC;SAC5F,MAAM,CAAC,WAAW,EAAE,8DAA8D,EAAE,KAAK,CAAC;SAC1F,MAAM,CAAC,KAAK,EAAE,IAAkB,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,KAAK,CAAC,yBAAyB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACrE,CAAC;QACD,MAAM,GAAG,GAAY;YACnB,GAAG;YACH,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;YACzB,eAAe,EAAE,IAAI,CAAC,eAAe,KAAK,IAAI;YAC9C,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,EAAE,EAAG,4BAA4B;YACzE,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC;SAC9B,CAAA;QACD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;QACjC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;AACN,CAAC;AAUD,4EAA4E;AAC5E,sBAAsB;AACtB,4EAA4E;AAE5E,KAAK,UAAU,WAAW,CAAC,GAAY;IACrC,GAAG,CAAC,IAAI,CAAC,yBAAyB,GAAG,CAAC,KAAK,SAAS,GAAG,CAAC,GAAG,CAAC,KAAK,YAAY,GAAG,CAAC,MAAM,EAAE,CAAC,CAAA;IAC1F,IAAI,CAAC;QACH,qEAAqE;QACrE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;QAEnE,yEAAyE;QACzE,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAA;QACnC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QAEhG,8DAA8D;QAC9D,MAAM,IAAI,CAAC,GAAG,EAAE,GAAwB,EAAE,eAAe,EACvD,GAAG,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,SAAS,CAAC,CAAY,CAAA;QACzD,2EAA2E;QAC3E,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,sEAAsE;QACtE,sDAAsD;QAEtD,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,CAAC,qEAAqE,CAAC,CAAA;YAClF,GAAG,CAAC,IAAI,CAAC,eAAe,SAAS,CAAC,MAAM,CAAC,MAAM,wBAAwB,CAAC,CAAA;YACxE,GAAG,CAAC,IAAI,CAAC,iBAAiB,SAAS,CAAC,UAAU,CAAC,MAAM,+BAA+B,CAAC,CAAA;YACrF,OAAO,IAAI,CAAA;QACb,CAAC;QAED,sEAAsE;QACtE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,eAAe,EACjD,GAAG,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;QAEtE,qEAAqE;QACrE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,mBAAmB,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAE5E,kEAAkE;QAClE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,qBAAqB,EACtC,GAAG,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;QAEhE,oEAAoE;QACpE,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,mBAAmB,EACpC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAA;QAEnE,0CAA0C;QAC1C,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,iBAAiB,EAClC,GAAG,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAA;QAE7E,+DAA+D;QAC/D,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,oBAAoB,EAAE,GAAG,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;QAEpF,oCAAoC;QACpC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAA;QAEnF,GAAG,CAAC,OAAO,CAAC,sCAAsC,GAAG,CAAC,KAAK,mDAAmD,CAAC,CAAA;QAC/G,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QAC5D,GAAG,CAAC,KAAK,CAAC,oCAAoC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAA;QAClF,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAA;QACtC,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,cAAc;AACd,4EAA4E;AAE5E,iEAAiE;AACjE,KAAK,UAAU,UAAU,CAAC,GAAY;IACpC,MAAM,IAAI,GAAG,MAAM,YAAY,CAC7B,GAAG,CAAC,GAAG,EAAE,UAAU,EACnB;oCACgC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAC7D,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,0BAA0B,CAAC,CAAA;IACrF,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,IAAI,CAAC,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,UAAU,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,OAAO,oCAAoC;YAC3E,oDAAoD,CACrD,CAAA;IACH,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,KAAK,0DAA0D,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAClC,GAAY,EAAE,KAAe,EAAE,IAAe;IAE9C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAA;IAClD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,qEAAqE;YACrE,gDAAgD;YAChD,mEAAmE;YACnE,qDAAqD;YACrD,0DAA0D,CAC3D,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,eAAe,CAC5B,GAAY,EAAE,IAAe,EAAE,SAA0B;IAEzD,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACjC,gCAAgC;QAChC,MAAM,IAAI,GAAG,MAAM,YAAY,CAC7B,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EACrB;;;;;;6BAMuB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;6BAChB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAC1C,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAA;YAC9C,SAAQ;QACV,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,CAAA;YACnC,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,CAAA;YACpE,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,CAAC,MAAM,0DAA0D;YACvF,uFAAuF;YACvF,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvC,CAAA;IACH,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,SAAS,CAAC,MAAM,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,YAAY,CAAC,CAAA;IACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACrB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,yBAAyB,CACtC,GAAY,EAAE,KAAe,EAAE,IAAe,EAAE,QAAsB;IAEtE,MAAM,QAAQ,GAA2B,EAAE,CAAA;IAC3C,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,gBAAgB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAA;QACjD,qEAAqE;QACrE,8EAA8E;QAC9E,6EAA6E;QAC7E,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,+DAA+D,CAAC,CAAA;YACvG,SAAQ;QACV,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QACvE,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAA;QACtC,UAAU,IAAI,CAAC,CAAA;IACjB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,oCAAoC,UAAU,EAAE,CAAC,CAAA;IACnH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AACvC,CAAC;AAED,yCAAyC;AACzC,KAAK,UAAU,iBAAiB,CAAC,GAAY,EAAE,KAAe;IAC5D,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,EAAE,UAAU,EACnB;kBACc,KAAK,CAAC,EAAE,gCAAgC,CACvD,CAAA;IACD,MAAM,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA,CAAE,gCAAgC;IAChF,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,mBAAmB,CAChC,GAAY,EAAE,KAAe,EAAE,QAAsB,EAAE,IAAe;IAEtE,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAA;IAC9C,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QACvD,MAAM,GAAG,GACP,0CAA0C;YAC1C,eAAe,MAAM,UAAU,CAAC,CAAC,SAAS,EAAE,CAAA;QAC9C,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAA;QAC9E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;QACpD,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CACb,eAAe,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,YAAY,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAChG,CAAA;QACH,CAAC;QACD,yEAAyE;QACzE,gEAAgE;QAChE,YAAY,EAAE,CAAA;IAChB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,CAAC,MAAM,oCAAoC,CAAC,CAAA;IAC/E,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;AAC1D,CAAC;AAED,yEAAyE;AACzE,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EAAE,KAAe,EAAE,QAAsB,EAAE,IAAe,EAAE,IAAe;IAEvF,IAAI,QAAQ,GAAG,CAAC,CAAA;IAChB,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QACtC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC/E,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,sBAAsB,CAAC,CAAA;YAClD,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,MAAM,SAAS,4BAA4B,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;QACjF,oEAAoE;QACpE,oEAAoE;QACpE,iEAAiE;QACjE,MAAM,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,aAAa,KAAK,mBAAmB,KAAK,YAAY,SAAS,6BAA6B,CAAC,CAAA;QACxG,CAAC;QACD,QAAQ,EAAE,CAAA;QACV,SAAS,IAAI,KAAK,CAAA;IACpB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,mBAAmB,QAAQ,SAAS,SAAS,EAAE,CAAC,CAAA;IACzD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAA;AACtC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAC7B,GAAY,EAAE,KAAe,EAAE,QAAsB,EACrD,IAAe,EAAE,IAAe,EAChC,WAA+D;IAE/D,IAAI,UAAU,GAAG,CAAC,CAAA;IAClB,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QACtC,YAAY;QACZ,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAC/E,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAChE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,WAAW,SAAS,mBAAmB,SAAS,WAAW,CAAC,CAAA;YACzF,UAAU,EAAE,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,MAAM,SAAS,IAAI,CAAC,CAAA;QAEhD,gDAAgD;QAChD,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,6CAA6C,CAAC,CAAA;YAC1E,SAAQ;QACV,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACjD,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAA;QAC1F,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QAChG,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,eAAe,QAAQ,aAAa,QAAQ,WAAW,CAAC,CAAA;YACrF,UAAU,EAAE,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,cAAc,KAAK,UAAU,QAAQ,IAAI,CAAC,CAAA;IACrD,CAAC;IAED,mCAAmC;IACnC,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;QAC3D,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,oCAAoC,OAAO,iCAAiC,CAAC,CAAA;QACzF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;QAClD,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ;YAAE,SAAQ;QAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAA;QAC/D,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAQ;QACpC,MAAM,GAAG,GAAG,MAAM,UAAU,CAC1B,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EACpC,gBAAgB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CACpC,CAAA;QACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,GAAG,CAAC,KAAK,CACP,cAAc,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,eAAe,QAAQ,QAAQ,GAAG,SAAS;gBAC5E,mFAAmF,CACpF,CAAA;YACD,SAAS,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAA;QACvC,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,kBAAkB,QAAQ,IAAI,CAAC,CAAA;QAC3E,CAAC;IACH,CAAC;IAED,GAAG,CAAC,IAAI,CACN,kCAAkC,QAAQ,CAAC,MAAM,eAAe,UAAU,GAAG;QAC7E,WAAW,OAAO,eAAe,SAAS,EAAE,CAC7C,CAAA;IAED,IAAI,UAAU,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,4CAA4C,UAAU,YAAY,OAAO,GAAG;YAC5E,cAAc,SAAS,sDAAsD,CAC9E,CAAA;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,CAAA;AACpE,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAY,EAAE,KAAe,EAAE,IAAe;IAE9C,MAAM,GAAG,GACP,UAAU;QACV,6FAA6F;QAC7F,cAAc,KAAK,CAAC,EAAE,yBAAyB;QAC/C,8DAA8D;QAC9D,2CAA2C,KAAK,CAAC,EAAE,KAAK;QACxD,mBAAmB,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,0BAA0B;QACjE,WAAW,CAAA;IACb,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,EAAE,GAAG,CAAC,CAAA;IAClD,IAAI,CAAC,GAAG,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACpF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;AAC7C,CAAC;AAED,6CAA6C;AAC7C,KAAK,UAAU,yBAAyB,CAAC,GAAY,EAAE,KAAe;IACpE,MAAM,MAAM,CACV,GAAG,CAAC,GAAG,EAAE,UAAU,EACnB;sEACkE,KAAK,CAAC,EAAE;gBAC9D,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,WAAW,CACzF,CAAA;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;AACzB,CAAC;AAED,4EAA4E;AAC5E,4BAA4B;AAC5B,4EAA4E;AAE5E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAsB;IACzD,OAAO,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK;YAAE,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA,CAAG,mBAAmB;QACvE,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QAClE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,kFAAkF;AAClF,KAAK,UAAU,WAAW,CAAC,GAAY,EAAE,KAAe;IACtD,MAAM,IAAI,GAAG,MAAM,YAAY,CAC7B,GAAG,CAAC,GAAG,EAAE,UAAU,EACnB;;+CAE2C,KAAK,CAAC,EAAE;;cAEzC,CACX,CAAA;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,gCAAgC,KAAK,CAAC,IAAI,wDAAwD,CACnG,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAA;AAChB,CAAC"}

package/dist/commands/deploy/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * CiCore CLI — Deploy commands (host-aware composition)
+ *
+ * `vu deploy core` and `vu deploy addon` are thin orchestration wrappers
+ * that compose the build/deploy steps already implemented in
+ * `commands/build/`. There is no separate deploy pipeline any more — the
+ * 689-line duplicate from the pre-host-aware era has been removed because
+ * every step it performed (image build/push, CDN upload, server pull/
+ * recreate, cache purge) now exists exactly once under `commands/build/`
+ * and gets called from both entry points.
+ *
+ *   `vu deploy core --host <h>`
+ *     ≡ vu build nuxt --host <h> --deploy --core <c>
+ *     + vu build php  --host <h> --deploy --core <c>
+ *
+ *   `vu deploy addon <name> --host <h>`
+ *     ≡ vu build addon <name> --host <h> --core <c>
+ *       (build/addon already does the full pipeline: vite → CDN → server)
+ *
+ * Keeping these as separate commands aids discoverability (`vu deploy`
+ * reads naturally for full-stack pushes) without duplicating the
+ * implementation behind them.
+ */
+import { Command } from 'commander';
+export declare function registerDeployCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/deploy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/deploy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AA8BnC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA6B7D"}

package/dist/commands/deploy/index.js

@@ -0,0 +1,107 @@
+/**
+ * CiCore CLI — Deploy commands (host-aware composition)
+ *
+ * `vu deploy core` and `vu deploy addon` are thin orchestration wrappers
+ * that compose the build/deploy steps already implemented in
+ * `commands/build/`. There is no separate deploy pipeline any more — the
+ * 689-line duplicate from the pre-host-aware era has been removed because
+ * every step it performed (image build/push, CDN upload, server pull/
+ * recreate, cache purge) now exists exactly once under `commands/build/`
+ * and gets called from both entry points.
+ *
+ *   `vu deploy core --host <h>`
+ *     ≡ vu build nuxt --host <h> --deploy --core <c>
+ *     + vu build php  --host <h> --deploy --core <c>
+ *
+ *   `vu deploy addon <name> --host <h>`
+ *     ≡ vu build addon <name> --host <h> --core <c>
+ *       (build/addon already does the full pipeline: vite → CDN → server)
+ *
+ * Keeping these as separate commands aids discoverability (`vu deploy`
+ * reads naturally for full-stack pushes) without duplicating the
+ * implementation behind them.
+ */
+import { log } from '../../lib/logger.js';
+import { buildNuxt, buildPHP, buildAddon, } from '../build/index.js';
+export function registerDeployCommands(program) {
+    const deploy = program.command('deploy').description('Full-pipeline deployment commands');
+    deploy
+        .command('core')
+        .description('Build + push + upload + recreate Nuxt and PHP on the given host')
+        .option('-h, --host <host>', 'Host alias (vucore | cicore)')
+        .option('-c, --core <core>', 'Core name for cache clearing', 'core1')
+        .option('--skip-cdn', 'Skip CDN upload (CoreUI)')
+        .option('--skip-push', 'Skip Docker Hub push')
+        .option('--skip-server', 'Skip server pull/restart')
+        .option('--skip-build', 'Skip Docker build (reuse existing :latest)')
+        .option('--skip-safelist', 'Skip addon CSS safelist regeneration')
+        .option('--dry-run', 'Show steps without executing')
+        .action(async (options) => {
+        await deployCore(options);
+    });
+    deploy
+        .command('addon <name>')
+        .description('Build addon UI + upload to CDN + install backend on the host')
+        .option('-h, --host <host>', 'Host alias (vucore | cicore)')
+        .option('-c, --core <core>', 'Target core', 'core1')
+        .option('--skip-cdn', 'Skip CDN upload')
+        .option('--skip-server', 'Skip backend deploy to server')
+        .option('--dry-run', 'Show steps without executing')
+        .action(async (name, options) => {
+        await deployAddon(name, options);
+    });
+}
+/**
+ * Full-stack core deploy: Nuxt then PHP, each going through its own build
+ * pipeline with `--deploy` enabled. Nuxt goes first because the PHP recreate
+ * doesn't strictly depend on Nuxt — running them sequentially keeps logs
+ * readable and avoids spiking Mac CPU with two concurrent buildx jobs.
+ *
+ * Returns early on Nuxt failure: a failed Nuxt build usually indicates the
+ * code state isn't shippable, so deploying just PHP would push a half-
+ * working release. Skip flags propagate to the underlying builds.
+ */
+async function deployCore(options) {
+    log.title('🚀 Deploy Core — Full Pipeline (Nuxt + PHP)');
+    const nuxtOpts = {
+        host: options.host,
+        core: options.core,
+        skipCdn: options.skipCdn,
+        skipPush: options.skipPush,
+        skipServer: options.skipServer,
+        skipBuild: options.skipBuild,
+        skipSafelist: options.skipSafelist,
+        deploy: true,
+        dryRun: options.dryRun,
+    };
+    await buildNuxt(nuxtOpts);
+    log.blank();
+    const phpOpts = {
+        host: options.host,
+        core: options.core,
+        skipPush: options.skipPush,
+        skipServer: options.skipServer,
+        deploy: true,
+        dryRun: options.dryRun,
+    };
+    await buildPHP(phpOpts);
+    log.blank();
+    log.success('✨ Core deploy complete (Nuxt + PHP)');
+}
+/**
+ * Addon deploy is the build pipeline as-is — `vu build addon` already does
+ * Vite build → CDN upload → backend stage → server install → cache purge.
+ * The wrapper exists so users can spell their intent as `vu deploy addon`.
+ */
+async function deployAddon(name, options) {
+    log.title(`🚀 Deploy Addon: ${name}`);
+    const buildOpts = {
+        host: options.host,
+        core: options.core,
+        skipCdn: options.skipCdn,
+        skipServer: options.skipServer,
+        dryRun: options.dryRun,
+    };
+    await buildAddon(name, buildOpts);
+}
+//# sourceMappingURL=index.js.map

package/dist/commands/deploy/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/deploy/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAA;AACzC,OAAO,EACL,SAAS,EACT,QAAQ,EACR,UAAU,GAIX,MAAM,mBAAmB,CAAA;AAqB1B,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC,mCAAmC,CAAC,CAAA;IAEzF,MAAM;SACH,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,iEAAiE,CAAC;SAC9E,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SAC3D,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,EAAE,OAAO,CAAC;SACpE,MAAM,CAAC,YAAY,EAAE,0BAA0B,CAAC;SAChD,MAAM,CAAC,aAAa,EAAE,sBAAsB,CAAC;SAC7C,MAAM,CAAC,eAAe,EAAE,0BAA0B,CAAC;SACnD,MAAM,CAAC,cAAc,EAAE,4CAA4C,CAAC;SACpE,MAAM,CAAC,iBAAiB,EAAE,sCAAsC,CAAC;SACjE,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,OAA0B,EAAE,EAAE;QAC3C,MAAM,UAAU,CAAC,OAAO,CAAC,CAAA;IAC3B,CAAC,CAAC,CAAA;IAEJ,MAAM;SACH,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,mBAAmB,EAAE,8BAA8B,CAAC;SAC3D,MAAM,CAAC,mBAAmB,EAAE,aAAa,EAAE,OAAO,CAAC;SACnD,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC;SACvC,MAAM,CAAC,eAAe,EAAE,+BAA+B,CAAC;SACxD,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAA2B,EAAE,EAAE;QAC1D,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,UAAU,CAAC,OAA0B;IAClD,GAAG,CAAC,KAAK,CAAC,6CAA6C,CAAC,CAAA;IAExD,MAAM,QAAQ,GAAqB;QACjC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;IACD,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAA;IAEzB,GAAG,CAAC,KAAK,EAAE,CAAA;IACX,MAAM,OAAO,GAAoB;QAC/B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;IACD,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IAEvB,GAAG,CAAC,KAAK,EAAE,CAAA;IACX,GAAG,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;AACpD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,OAA2B;IAClE,GAAG,CAAC,KAAK,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAA;IACrC,MAAM,SAAS,GAAsB;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAA;IACD,MAAM,UAAU,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;AACnC,CAAC"}

package/dist/commands/devops/index.d.ts

@@ -0,0 +1,6 @@
+/**
+ * CiCore CLI - DevOps Commands
+ */
+import { Command } from 'commander';
+export declare function registerDevOpsCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/devops/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/devops/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAKpC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAuC7D"}