@cicore/cli 1.0.0

package/dist/lib/ops/cdn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdn.js","sourceRoot":"","sources":["../../../src/lib/ops/cdn.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEjD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAgBlC,MAAM,UAAU,GAAc,MAAM,CAAC,MAAM,CAAC;IAC1C,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,GAAG;IACX,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;IAC3B,YAAY,EAAE,EAAE;CACjB,CAAC,CAAA;AAEF,4EAA4E;AAC5E,mBAAmB;AACnB,4EAA4E;AAE5E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAe;IAClD,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACzB,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,SAAS,eAAe,CAAC,CAAA;QACxE,OAAO,UAAU,CAAA;IACnB,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,gCAAgC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACzD,OAAO,UAAU,CAAC,GAAG,EAAE,sBAAsB,EAAE,EAAE,CAAC,CAAA;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAe,EACf,KAAa,EACb,OAAsC,EAAE;IAExC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAA;IACxC,GAAG,CAAC,IAAI,CAAC,sBAAsB,KAAK,IAAI,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACtE,OAAO,UAAU,CAAC,GAAG,EAAE,cAAc,EAAE;QACrC,YAAY,EAAE;YACZ,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,OAAO;SACrB;KACF,CAAC,CAAA;AACJ,CAAC;AA0BD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,OAAe,EACf,OAAyB,EAAE;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAA;IACpE,IAAI,QAAQ,IAAI,GAAG,CAAC,gBAAgB,EAAE,CAAC;QACrC,GAAG,CAAC,IAAI,CAAC,kCAAkC,GAAG,CAAC,SAAS,gBAAgB,CAAC,CAAA;QACzE,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAA;IACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;IAC5C,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,CAAA;IAC1D,GAAG,CAAC,IAAI,CACN,gBAAgB,KAAK,IAAI,OAAO,OAAO,GAAG,CAAC,SAAS,GAAG;QACrD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAC3C,CAAA;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAA;IACpC,MAAM,YAAY,GAA2B,EAAE,WAAW,EAAE,OAAO,EAAE,CAAA;IACrE,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC1C,YAAY,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,KAAK,CAAA;IACtC,CAAC;IACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;QACnC,YAAY,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,WAAW,CAAA;IACnD,CAAC;IAED,OAAO,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE;QAC3C,IAAI;QACJ,WAAW,EAAE,iBAAiB;QAC9B,YAAY;KACb,CAAC,CAAA;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,GAAe,EAAE,YAAoB;IAC3E,OAAO,UAAU,CAAC,GAAG,EAAE,kBAAkB,EAAE;QACzC,IAAI,EAAE,YAAY;QAClB,WAAW,EAAE,kBAAkB;KAChC,CAAC,CAAA;AACJ,CAAC;AAyBD,KAAK,UAAU,UAAU,CACvB,GAAe,EACf,IAAY,EACZ,IAAiB;IAEjB,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,WAAW,GAAG,IAAI,EAAE,CAAA;IACvC,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAA;QAChC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,CAAA;IAE/E,IAAI,CAAC;QACH,MAAM,OAAO,GAA2B;YACtC,WAAW,EAAE,GAAG,CAAC,SAAS;YAC1B,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;SAC7B,CAAA;QACD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC,WAAW,CAAA;QAE9E,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QAEF,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,MAAM,IAAI,GAAY,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC;YACtF,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC;YACrB,CAAC,CAAC,IAAI,CAAA;QAER,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,QAAQ,CAAC,EAAE;YACpB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,IAAI;YACJ,YAAY,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAClF,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY;gBAC3B,CAAC,CAAC,2BAA2B,IAAI,CAAC,SAAS,IAAI,OAAO,IAAI;gBAC1D,CAAC,CAAC,KAAK,CAAC,OAAO;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,CAAC;YACT,IAAI,EAAE,IAAI;YACV,YAAY,EAAE,OAAO;SACtB,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY;IACjC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/lib/ops/cf.d.ts

@@ -0,0 +1,36 @@
+/**
+ * CiCore CLI — Cloudflare zone primitives
+ *
+ * Host-aware Cloudflare API calls for cache purge. Uses `cfg.cfZoneId` to
+ * scope each call to the right zone and `cfg.cfApiToken` (Bearer) for auth.
+ *
+ * Two purge modes:
+ *   - {@link cfPurgeZone}: wipe the whole zone's edge cache. Use after a
+ *     core deploy when many assets changed. Fast, but invalidates third-
+ *     party content (e.g. /admin assets, public site) — accept the cost.
+ *   - {@link cfPurgePaths}: surgical, list of specific URLs. Use for
+ *     addon redeploys where only `cdn.X.com.tr/addons/<addon>/...` changed.
+ *
+ * Cloudflare's `/purge_cache` accepts up to 30 URLs per request on free
+ * plans, 500 on paid. We chunk on the lower bound (30) to stay safe across
+ * accounts; can lift later if profiling shows it matters.
+ */
+import type { HostConfig } from '../hosts.js';
+export interface CfResult {
+    readonly success: boolean;
+    readonly status: number;
+    readonly errorMessage: string;
+}
+/** Purge every cached asset in the zone. */
+export declare function cfPurgeZone(cfg: HostConfig): Promise<CfResult>;
+/**
+ * Purge a specific list of URLs from the edge cache.
+ *
+ * URLs must be absolute. Empty list returns success without making the
+ * request (avoiding the 400 CF returns for empty `files`). The list is
+ * chunked at {@link CHUNK_SIZE} entries; sequential requests because CF
+ * rate-limits the purge endpoint and parallel doesn't help wall time
+ * meaningfully for typical addon purges (<200 URLs).
+ */
+export declare function cfPurgePaths(cfg: HostConfig, urls: readonly string[]): Promise<CfResult>;
+//# sourceMappingURL=cf.d.ts.map

package/dist/lib/ops/cf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf.d.ts","sourceRoot":"","sources":["../../../src/lib/ops/cf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAQ7C,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;CAC9B;AAYD,4CAA4C;AAC5C,wBAAsB,WAAW,CAAC,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAIpE;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,OAAO,CAAC,QAAQ,CAAC,CAcnB"}

package/dist/lib/ops/cf.js

@@ -0,0 +1,114 @@
+/**
+ * CiCore CLI — Cloudflare zone primitives
+ *
+ * Host-aware Cloudflare API calls for cache purge. Uses `cfg.cfZoneId` to
+ * scope each call to the right zone and `cfg.cfApiToken` (Bearer) for auth.
+ *
+ * Two purge modes:
+ *   - {@link cfPurgeZone}: wipe the whole zone's edge cache. Use after a
+ *     core deploy when many assets changed. Fast, but invalidates third-
+ *     party content (e.g. /admin assets, public site) — accept the cost.
+ *   - {@link cfPurgePaths}: surgical, list of specific URLs. Use for
+ *     addon redeploys where only `cdn.X.com.tr/addons/<addon>/...` changed.
+ *
+ * Cloudflare's `/purge_cache` accepts up to 30 URLs per request on free
+ * plans, 500 on paid. We chunk on the lower bound (30) to stay safe across
+ * accounts; can lift later if profiling shows it matters.
+ */
+import { isDryRun } from '../config.js';
+import { log } from '../logger.js';
+const DRY_RUN_OK = Object.freeze({
+    success: true,
+    status: 200,
+    errorMessage: '',
+});
+// ─────────────────────────────────────────────────────────────────────────
+// Public primitives
+// ─────────────────────────────────────────────────────────────────────────
+/** Purge every cached asset in the zone. */
+export async function cfPurgeZone(cfg) {
+    ensureZoneConfigured(cfg);
+    log.info(`[cf] zone-wide purge on ${cfg.brandName}`);
+    return postPurge(cfg, { purge_everything: true });
+}
+/**
+ * Purge a specific list of URLs from the edge cache.
+ *
+ * URLs must be absolute. Empty list returns success without making the
+ * request (avoiding the 400 CF returns for empty `files`). The list is
+ * chunked at {@link CHUNK_SIZE} entries; sequential requests because CF
+ * rate-limits the purge endpoint and parallel doesn't help wall time
+ * meaningfully for typical addon purges (<200 URLs).
+ */
+export async function cfPurgePaths(cfg, urls) {
+    ensureZoneConfigured(cfg);
+    if (urls.length === 0) {
+        log.debug('[cf] purgePaths called with empty list — no-op');
+        return DRY_RUN_OK;
+    }
+    log.info(`[cf] purge ${urls.length} URL${urls.length === 1 ? '' : 's'} on ${cfg.brandName}`);
+    for (let i = 0; i < urls.length; i += CHUNK_SIZE) {
+        const chunk = urls.slice(i, i + CHUNK_SIZE);
+        const result = await postPurge(cfg, { files: [...chunk] });
+        if (!result.success)
+            return result;
+    }
+    return Object.freeze({ success: true, status: 200, errorMessage: '' });
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Internal
+// ─────────────────────────────────────────────────────────────────────────
+/** Max URLs per `/purge_cache` request. Conservative to fit Free plan limit. */
+const CHUNK_SIZE = 30;
+async function postPurge(cfg, body) {
+    const url = `https://api.cloudflare.com/client/v4/zones/${cfg.cfZoneId}/purge_cache`;
+    if (isDryRun()) {
+        log.debug('[dry-run] POST', url, 'body:', JSON.stringify(body));
+        return DRY_RUN_OK;
+    }
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${cfg.cfApiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify(body),
+            signal: controller.signal,
+        });
+        if (response.ok) {
+            return Object.freeze({ success: true, status: response.status, errorMessage: '' });
+        }
+        const text = await response.text();
+        return Object.freeze({
+            success: false,
+            status: response.status,
+            errorMessage: `HTTP ${response.status}: ${text.slice(0, 200)}`,
+        });
+    }
+    catch (error) {
+        const message = error instanceof Error
+            ? error.name === 'AbortError'
+                ? 'Cloudflare purge timed out after 30s'
+                : error.message
+            : String(error);
+        return Object.freeze({ success: false, status: 0, errorMessage: message });
+    }
+    finally {
+        clearTimeout(timeout);
+    }
+}
+/**
+ * Throw a clear error if the host's Cloudflare zone isn't configured yet.
+ * Vucore prod's cfZoneId is currently empty (see hosts.ts) — purge calls
+ * for that host must be wired up via env-fallback before they can run.
+ */
+function ensureZoneConfigured(cfg) {
+    if (!cfg.cfZoneId || cfg.cfZoneId.trim() === '') {
+        throw new Error(`Host '${cfg.alias}' has no cfZoneId configured. ` +
+            `Set it in STATIC_TOPOLOGY (cli/src/lib/hosts.ts) before using Cloudflare ops.`);
+    }
+}
+//# sourceMappingURL=cf.js.map

package/dist/lib/ops/cf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cf.js","sourceRoot":"","sources":["../../../src/lib/ops/cf.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACvC,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAYlC,MAAM,UAAU,GAAa,MAAM,CAAC,MAAM,CAAC;IACzC,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,GAAG;IACX,YAAY,EAAE,EAAE;CACjB,CAAC,CAAA;AAEF,4EAA4E;AAC5E,oBAAoB;AACpB,4EAA4E;AAE5E,4CAA4C;AAC5C,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAe;IAC/C,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACzB,GAAG,CAAC,IAAI,CAAC,2BAA2B,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACpD,OAAO,SAAS,CAAC,GAAG,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,GAAe,EACf,IAAuB;IAEvB,oBAAoB,CAAC,GAAG,CAAC,CAAA;IACzB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,GAAG,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAA;QAC3D,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,UAAU,EAAE,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAA;QAC1D,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,MAAM,CAAA;IACpC,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;AACxE,CAAC;AAED,4EAA4E;AAC5E,WAAW;AACX,4EAA4E;AAE5E,gFAAgF;AAChF,MAAM,UAAU,GAAG,EAAE,CAAA;AAOrB,KAAK,UAAU,SAAS,CAAC,GAAe,EAAE,IAAe;IACvD,MAAM,GAAG,GAAG,8CAA8C,GAAG,CAAC,QAAQ,cAAc,CAAA;IACpF,IAAI,QAAQ,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/D,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAA;IACxC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAA;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,GAAG,CAAC,UAAU,EAAE;gBACzC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAA;QACF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAA;QACpF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;QAClC,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,YAAY,EAAE,QAAQ,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;SAC/D,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,OAAO,GACX,KAAK,YAAY,KAAK;YACpB,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY;gBAC3B,CAAC,CAAC,sCAAsC;gBACxC,CAAC,CAAC,KAAK,CAAC,OAAO;YACjB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACnB,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC,CAAA;IAC5E,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,OAAO,CAAC,CAAA;IACvB,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,GAAe;IAC3C,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,SAAS,GAAG,CAAC,KAAK,gCAAgC;YAChD,+EAA+E,CAClF,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/lib/ops/compose.d.ts

@@ -0,0 +1,95 @@
+/**
+ * CiCore CLI — docker compose primitives
+ *
+ * Thin host-aware wrappers around `docker compose` on the remote host.
+ * Two layouts are supported transparently via {@link composeArgs}:
+ *
+ *   - split (vucore prod):  `docker compose -f docker-core-<svc>.yml up -d`
+ *                            no service positional — compose file is single-service
+ *
+ *   - single (cicore):       `docker compose -f docker-compose.yml up -d <svc>`
+ *                            service positional required — multi-service file
+ *
+ * Every primitive uses `cd <workDir> && docker compose ...` because the
+ * compose file path in `composeArgs` is relative to `workDir`. The cd is
+ * the only safe way to run compose against relative paths.
+ *
+ * `--no-deps` is the default for `up`-style ops: we deliberately only
+ * recreate the targeted service, not its dependencies (postgres, redis).
+ * Bringing down healthy dependencies would cause a multi-second outage on
+ * every deploy for no good reason.
+ */
+import { type AppServiceKey, type HostConfig } from '../hosts.js';
+import { type ExecResult } from './ssh.js';
+interface RunComposeOptions {
+    readonly silent?: boolean;
+    readonly stream?: boolean;
+}
+/**
+ * Start (or recreate if image changed) a single service in detached mode.
+ *
+ * If the image reference in the compose file already maps to a running
+ * container with the same image digest, compose treats this as a no-op
+ * (logs "Container ... Running" instead of "Recreated"). For a guaranteed
+ * recreation use {@link composeForceRecreate}.
+ *
+ * `--no-deps` excludes postgres/redis from the dependency walk.
+ */
+export declare function composeUp(cfg: HostConfig, service: AppServiceKey, opts?: RunComposeOptions): Promise<ExecResult>;
+/**
+ * Force-recreate a service container, even if compose can't detect a change.
+ *
+ * Necessary when the compose-target image (`baynis/vucore-<svc>:latest`)
+ * has been retagged to a new digest *outside* compose's view — compose
+ * compares container labels against the compose file, not the underlying
+ * image, so a retag alone doesn't trigger recreation.
+ *
+ * Equivalent to: stop → rm → up. Causes ~5-15s downtime per service.
+ */
+export declare function composeForceRecreate(cfg: HostConfig, service: AppServiceKey, opts?: RunComposeOptions): Promise<ExecResult>;
+/**
+ * Restart a running container in place — no image change, no recreation.
+ * Useful for picking up environment file edits without an image churn.
+ */
+export declare function composeRestart(cfg: HostConfig, service: AppServiceKey, opts?: RunComposeOptions): Promise<ExecResult>;
+/**
+ * Stop and remove the container for a service. The image is preserved.
+ *
+ * Implemented as `stop` + `rm -f` rather than `down` because `docker
+ * compose down <service>` is invalid syntax — `down` is a global op that
+ * ignores positional args and would tear down every service in the file.
+ */
+export declare function composeStop(cfg: HostConfig, service: AppServiceKey, opts?: RunComposeOptions): Promise<ExecResult>;
+/**
+ * Pull the image referenced by the compose file from its registry.
+ * On cicore the compose file expects `baynis/vucore-*:latest`, but those
+ * tags don't exist there — the retag-after-pull pattern in image.ts handles
+ * that. So this primitive is mostly used on vucore prod.
+ */
+export declare function composePull(cfg: HostConfig, service: AppServiceKey, opts?: RunComposeOptions): Promise<ExecResult>;
+/**
+ * Parse `docker compose ps --format '{{.Service}}|{{.Status}}|{{.Image}}'`
+ * output into a structured list. Returns an empty array on failure rather
+ * than throwing — callers checking "is service X up?" can fall through.
+ */
+export interface ComposeServiceStatus {
+    readonly service: string;
+    readonly status: string;
+    readonly image: string;
+}
+export declare function composeStatus(cfg: HostConfig, opts?: {
+    readonly silent?: boolean;
+}): Promise<readonly ComposeServiceStatus[]>;
+/**
+ * Wait for a service container to become healthy, polling `docker compose ps`.
+ *
+ * Returns the final status (true if healthy, false on timeout). Default
+ * timeout 60s, poll every 2s. Used by setup to gate progress until the
+ * stack is reachable before running migrations.
+ */
+export declare function waitForHealthy(cfg: HostConfig, service: AppServiceKey, opts?: {
+    readonly timeoutMs?: number;
+    readonly pollIntervalMs?: number;
+}): Promise<boolean>;
+export {};
+//# sourceMappingURL=compose.d.ts.map

package/dist/lib/ops/compose.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../../src/lib/ops/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,KAAK,aAAa,EAAe,KAAK,UAAU,EAAE,MAAM,aAAa,CAAA;AAE9E,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAMrD,UAAU,iBAAiB;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAC1B;AAiCD;;;;;;;;;GASG;AACH,wBAAsB,SAAS,CAC7B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAGrB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAKrB;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE,iBAAsB,GAC3B,OAAO,CAAC,UAAU,CAAC,CAGrB;AAMD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,UAAU,EACf,IAAI,GAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAsB1C;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,GAAG,EAAE,UAAU,EACf,OAAO,EAAE,aAAa,EACtB,IAAI,GAAE;IAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3E,OAAO,CAAC,OAAO,CAAC,CAkBlB"}

package/dist/lib/ops/compose.js

@@ -0,0 +1,165 @@
+/**
+ * CiCore CLI — docker compose primitives
+ *
+ * Thin host-aware wrappers around `docker compose` on the remote host.
+ * Two layouts are supported transparently via {@link composeArgs}:
+ *
+ *   - split (vucore prod):  `docker compose -f docker-core-<svc>.yml up -d`
+ *                            no service positional — compose file is single-service
+ *
+ *   - single (cicore):       `docker compose -f docker-compose.yml up -d <svc>`
+ *                            service positional required — multi-service file
+ *
+ * Every primitive uses `cd <workDir> && docker compose ...` because the
+ * compose file path in `composeArgs` is relative to `workDir`. The cd is
+ * the only safe way to run compose against relative paths.
+ *
+ * `--no-deps` is the default for `up`-style ops: we deliberately only
+ * recreate the targeted service, not its dependencies (postgres, redis).
+ * Bringing down healthy dependencies would cause a multi-second outage on
+ * every deploy for no good reason.
+ */
+import { composeArgs } from '../hosts.js';
+import { log } from '../logger.js';
+import { runRemote } from './ssh.js';
+/**
+ * Build and execute the compose command line for a service. Composes:
+ *
+ *   cd <workDir> && docker compose <fileFlag> <subcommand> <flags...> <serviceArg>
+ *
+ * `serviceArg` is empty for split-layout hosts (compose file is already
+ * scoped to one service); it carries the service name for single-file
+ * hosts. {@link composeArgs} encapsulates that logic.
+ */
+async function runCompose(cfg, service, subcommand, opts = {}) {
+    const { fileFlag, serviceArg } = composeArgs(cfg, service);
+    // Service arg goes at the end of the compose invocation — `up -d <flags> <svc>`,
+    // `restart <svc>`, etc. Empty string is filtered to avoid producing trailing
+    // whitespace that some compose versions complain about.
+    const parts = [
+        `cd ${cfg.workDir}`,
+        `docker compose ${fileFlag} ${subcommand.join(' ')}${serviceArg ? ' ' + serviceArg : ''}`,
+    ];
+    const cmd = parts.join(' && ');
+    return runRemote(cfg, cmd, { silent: opts.silent, stream: opts.stream });
+}
+// ─────────────────────────────────────────────────────────────────────────
+// Lifecycle primitives
+// ─────────────────────────────────────────────────────────────────────────
+/**
+ * Start (or recreate if image changed) a single service in detached mode.
+ *
+ * If the image reference in the compose file already maps to a running
+ * container with the same image digest, compose treats this as a no-op
+ * (logs "Container ... Running" instead of "Recreated"). For a guaranteed
+ * recreation use {@link composeForceRecreate}.
+ *
+ * `--no-deps` excludes postgres/redis from the dependency walk.
+ */
+export async function composeUp(cfg, service, opts = {}) {
+    if (!opts.silent)
+        log.info(`compose up -d ${service} on ${cfg.brandName}`);
+    return runCompose(cfg, service, ['up', '-d', '--no-deps'], opts);
+}
+/**
+ * Force-recreate a service container, even if compose can't detect a change.
+ *
+ * Necessary when the compose-target image (`baynis/vucore-<svc>:latest`)
+ * has been retagged to a new digest *outside* compose's view — compose
+ * compares container labels against the compose file, not the underlying
+ * image, so a retag alone doesn't trigger recreation.
+ *
+ * Equivalent to: stop → rm → up. Causes ~5-15s downtime per service.
+ */
+export async function composeForceRecreate(cfg, service, opts = {}) {
+    if (!opts.silent)
+        log.info(`compose up -d --force-recreate ${service} on ${cfg.brandName}`);
+    return runCompose(cfg, service, ['up', '-d', '--force-recreate', '--no-deps'], opts);
+}
+/**
+ * Restart a running container in place — no image change, no recreation.
+ * Useful for picking up environment file edits without an image churn.
+ */
+export async function composeRestart(cfg, service, opts = {}) {
+    if (!opts.silent)
+        log.info(`compose restart ${service} on ${cfg.brandName}`);
+    return runCompose(cfg, service, ['restart'], opts);
+}
+/**
+ * Stop and remove the container for a service. The image is preserved.
+ *
+ * Implemented as `stop` + `rm -f` rather than `down` because `docker
+ * compose down <service>` is invalid syntax — `down` is a global op that
+ * ignores positional args and would tear down every service in the file.
+ */
+export async function composeStop(cfg, service, opts = {}) {
+    if (!opts.silent)
+        log.info(`compose stop+rm ${service} on ${cfg.brandName}`);
+    const stop = await runCompose(cfg, service, ['stop'], opts);
+    if (!stop.success)
+        return stop;
+    return runCompose(cfg, service, ['rm', '-f'], opts);
+}
+/**
+ * Pull the image referenced by the compose file from its registry.
+ * On cicore the compose file expects `baynis/vucore-*:latest`, but those
+ * tags don't exist there — the retag-after-pull pattern in image.ts handles
+ * that. So this primitive is mostly used on vucore prod.
+ */
+export async function composePull(cfg, service, opts = {}) {
+    if (!opts.silent)
+        log.info(`compose pull ${service} on ${cfg.brandName}`);
+    return runCompose(cfg, service, ['pull'], opts);
+}
+export async function composeStatus(cfg, opts = {}) {
+    // Use the nuxt compose file as the "entry point" for ps; for single-file
+    // hosts that's the whole stack, for split layout it's just one service —
+    // ps via -f reports for that file only. Callers wanting cross-file status
+    // on split layout should call this per-service-file.
+    const { fileFlag } = composeArgs(cfg, 'nuxt');
+    const cmd = `cd ${cfg.workDir} && docker compose ${fileFlag} ps --format '{{.Service}}|{{.Status}}|{{.Image}}'`;
+    const result = await runRemote(cfg, cmd, { silent: opts.silent ?? true });
+    if (!result.success)
+        return [];
+    return result.stdout
+        .split('\n')
+        .map(line => line.trim())
+        .filter(line => line.length > 0)
+        .map(line => {
+        const [service, status, image] = line.split('|');
+        return Object.freeze({
+            service: service ?? '',
+            status: status ?? '',
+            image: image ?? '',
+        });
+    });
+}
+/**
+ * Wait for a service container to become healthy, polling `docker compose ps`.
+ *
+ * Returns the final status (true if healthy, false on timeout). Default
+ * timeout 60s, poll every 2s. Used by setup to gate progress until the
+ * stack is reachable before running migrations.
+ */
+export async function waitForHealthy(cfg, service, opts = {}) {
+    const timeoutMs = opts.timeoutMs ?? 60_000;
+    const pollMs = opts.pollIntervalMs ?? 2_000;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        const statuses = await composeStatus(cfg, { silent: true });
+        const target = statuses.find(s => s.service === service);
+        if (target && /\(healthy\)/.test(target.status)) {
+            return true;
+        }
+        if (target && /Up\b/.test(target.status) && !/health/.test(target.status)) {
+            // Service is up but has no healthcheck defined — treat as ready.
+            return true;
+        }
+        await sleep(pollMs);
+    }
+    return false;
+}
+function sleep(ms) {
+    return new Promise(resolve => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=compose.js.map

package/dist/lib/ops/compose.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"compose.js","sourceRoot":"","sources":["../../../src/lib/ops/compose.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAsB,WAAW,EAAmB,MAAM,aAAa,CAAA;AAC9E,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAClC,OAAO,EAAE,SAAS,EAAmB,MAAM,UAAU,CAAA;AAWrD;;;;;;;;GAQG;AACH,KAAK,UAAU,UAAU,CACvB,GAAe,EACf,OAAsB,EACtB,UAA6B,EAC7B,OAA0B,EAAE;IAE5B,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAC1D,iFAAiF;IACjF,6EAA6E;IAC7E,wDAAwD;IACxD,MAAM,KAAK,GAAG;QACZ,MAAM,GAAG,CAAC,OAAO,EAAE;QACnB,kBAAkB,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE;KAC1F,CAAA;IACD,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9B,OAAO,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAA;AAC1E,CAAC;AAED,4EAA4E;AAC5E,uBAAuB;AACvB,4EAA4E;AAE5E;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAe,EACf,OAAsB,EACtB,OAA0B,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC1E,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;AAClE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAe,EACf,OAAsB,EACtB,OAA0B,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,kCAAkC,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC3F,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,EAAE,WAAW,CAAC,EAAE,IAAI,CAAC,CAAA;AACtF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAe,EACf,OAAsB,EACtB,OAA0B,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5E,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,CAAA;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,OAAsB,EACtB,OAA0B,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,mBAAmB,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IAC5E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;IAC3D,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAA;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAe,EACf,OAAsB,EACtB,OAA0B,EAAE;IAE5B,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,GAAG,CAAC,IAAI,CAAC,gBAAgB,OAAO,OAAO,GAAG,CAAC,SAAS,EAAE,CAAC,CAAA;IACzE,OAAO,UAAU,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAA;AACjD,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAe,EACf,OAAsC,EAAE;IAExC,yEAAyE;IACzE,yEAAyE;IACzE,0EAA0E;IAC1E,qDAAqD;IACrD,MAAM,EAAE,QAAQ,EAAE,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7C,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,sBAAsB,QAAQ,oDAAoD,CAAA;IAC/G,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;IACzE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IAE9B,OAAO,MAAM,CAAC,MAAM;SACjB,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;SAC/B,GAAG,CAAC,IAAI,CAAC,EAAE;QACV,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,OAAO,EAAE,OAAO,IAAI,EAAE;YACtB,MAAM,EAAE,MAAM,IAAI,EAAE;YACpB,KAAK,EAAE,KAAK,IAAI,EAAE;SACnB,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAe,EACf,OAAsB,EACtB,OAA0E,EAAE;IAE5E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAA;IAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,IAAI,KAAK,CAAA;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAA;IAEvC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAA;QACxD,IAAI,MAAM,IAAI,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1E,iEAAiE;YACjE,OAAO,IAAI,CAAA;QACb,CAAC;QACD,MAAM,KAAK,CAAC,MAAM,CAAC,CAAA;IACrB,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AACxD,CAAC"}

package/dist/lib/ops/core.d.ts

@@ -0,0 +1,117 @@
+/**
+ * CiCore CLI — Core skeleton + environment primitives
+ *
+ * A "core" is one logical SaaS instance inside the multi-core VuCore
+ * stack. Each core lives in its own subdirectory under `cfg.coresHostPath`
+ * with its own `.env`, addons/, storage/, etc. The PHP and Nuxt containers
+ * are shared across cores — runtime routing (nginx $target_core) picks
+ * which core handles a given request.
+ *
+ * This module provides the primitives `vu setup` needs to onboard a new
+ * core:
+ *
+ *   - {@link coreEnsureSkeleton}: server-side mkdir of the standard layout
+ *   - {@link coreEnvGenerate}: build a config object from host + per-core
+ *                              inputs (domain, name, secrets)
+ *   - {@link coreWriteEnv}: serialize the config and write it atomically
+ *                            to `<coresHostPath>/<core>/.env`
+ *
+ * Secrets (DB password, JWT) are generated with `crypto.randomBytes` — 32
+ * bytes hex, suitable for both. The caller can override via options to
+ * support importing an existing core's secrets.
+ */
+import type { HostConfig } from '../hosts.js';
+import { type ExecResult } from './ssh.js';
+/**
+ * Create `cores/<name>/` and its subdirectories on the server if missing.
+ * Permissions are set so PHP container's www-data (uid 82) can write into
+ * the storage/ tree. Files outside storage/ keep root-owned defaults.
+ *
+ * Idempotent — safe to call repeatedly. Returns success when every dir
+ * exists (whether we created it or it was already there).
+ */
+export declare function coreEnsureSkeleton(cfg: HostConfig, coreName: string): Promise<ExecResult>;
+/** Inputs that drive `.env` generation — what differs per core. */
+export interface CoreEnvInputs {
+    /** Primary domain for this core (e.g. `cicore.com.tr`). */
+    readonly domain: string;
+    /** Additional comma-separated domains the core also serves. */
+    readonly additionalDomains?: string;
+    /**
+     * Postgres LOGIN role for this core (per-core isolation; replaces the
+     * shared admin pattern). If omitted, `coreEnvGenerate` produces a
+     * core-derived random name `db_<core>_<8hex>`. The setup orchestrator
+     * passes the same role to `dbCreateRoleAndDb` so the postgres ROLE
+     * and the .env stay in sync.
+     */
+    readonly dbUser?: string;
+    /** Override the auto-generated DB password (e.g. importing an existing core). */
+    readonly dbPassword?: string;
+    /** Override the auto-generated JWT secret. */
+    readonly jwtSecret?: string;
+    /** Brand identifier — drives Nuxt useBrand() defaults. Defaults to core name. */
+    readonly brand?: string;
+}
+/**
+ * Build the full `.env` config object from the host topology and per-core
+ * inputs. Values are simple strings — caller serializes via
+ * {@link coreWriteEnv} when ready.
+ *
+ * Secrets default to fresh 32-byte hex values; pass overrides via
+ * `inputs.dbPassword` / `inputs.jwtSecret` when reusing an existing core's
+ * credentials (e.g. clone, restore).
+ */
+export declare function coreEnvGenerate(cfg: HostConfig, coreName: string, inputs: CoreEnvInputs): Readonly<Record<string, string>>;
+/**
+ * Serialize an env config to dotenv format and write atomically to the
+ * server at `cores/<coreName>/.env`.
+ *
+ * Format: `KEY=value` per line, no quoting (values must be free of
+ * newlines and unescaped `"`/`'`). Generated secrets meet this; caller
+ * overrides should too.
+ *
+ * Atomic via temp file + mv inside the same script. If a previous .env
+ * exists, it's backed up to `.env.bak-<timestamp>` so a botched setup is
+ * recoverable. Idempotent: writing the same content twice is a no-op
+ * (transform short-circuits when content matches).
+ */
+export declare function coreWriteEnv(cfg: HostConfig, coreName: string, env: Readonly<Record<string, string>>): Promise<ExecResult>;
+/**
+ * Parse the existing `.env` on the server into a plain object. Useful for
+ * re-using an existing core's secrets when adding domains or for
+ * inspection. Returns an empty object if the file doesn't exist.
+ *
+ * Best-effort parsing: supports `KEY=value` and `KEY="value"`, skips blank
+ * lines and `#` comments. Doesn't expand `$VAR` references — values are
+ * returned verbatim.
+ */
+export declare function coreReadEnv(cfg: HostConfig, coreName: string): Promise<Record<string, string>>;
+/**
+ * The brand identity shape projected into `cores/<slug>/brand.json`. This is
+ * the contract the Nuxt runtime reads (core-loader → useBrand → VBrandLogo +
+ * titleTemplate). Mirrors `BrandService::reconcileBrandJson` (PHP) exactly —
+ * the CLI is the canonical writer; PHP mirrors it for panel-driven edits.
+ */
+export interface BrandProjection {
+    readonly brand: string;
+    readonly title: string;
+    readonly logoUrl: string | null;
+    readonly faviconUrl: string | null;
+    readonly theme: Record<string, unknown>;
+}
+/**
+ * Project a brand into `cores/<slug>/brand.json` on the host, idempotently.
+ *
+ * Reads the existing file and compares *semantically* (parsed + key-sorted),
+ * so formatting differences between the PHP and CLI writers never register as
+ * drift — only a real identity change rewrites the file. Returns whether the
+ * file changed so `ci brand reconcile` can report an honest unchanged/written
+ * summary. The freshly-written file is chowned to the PHP runtime uid so the
+ * container can read it.
+ */
+export declare function coreReconcileBrandJson(cfg: HostConfig, slug: string, projection: BrandProjection): Promise<{
+    success: boolean;
+    changed: boolean;
+    stderr: string;
+}>;
+//# sourceMappingURL=core.d.ts.map

package/dist/lib/ops/core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/lib/ops/core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAE7C,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,UAAU,CAAA;AAoCtE;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,UAAU,CAAC,CA+BrB;AA2BD,mEAAmE;AACnE,MAAM,WAAW,aAAa;IAC5B,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,iFAAiF;IACjF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;IAC3B,iFAAiF;IACjF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,aAAa,GACpB,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAwClC;AAMD;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GACpC,OAAO,CAAC,UAAU,CAAC,CAgCrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,GAAG,EAAE,UAAU,EACf,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CA0BjC;AAMD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACxC;AAED;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,UAAU,EACf,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,eAAe,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CA+BjE"}