@factiii/stack 0.1.2

package/dist/cli/init.js

@@ -0,0 +1,190 @@
+"use strict";
+/**
+ * Init Command
+ *
+ * Initializes factiii.yml in a project
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.init = init;
+const path = __importStar(require("path"));
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const child_process_1 = require("child_process");
+const generate_factiii_yml_js_1 = require("../generators/generate-factiii-yml.js");
+const generate_factiii_auto_js_1 = require("../generators/generate-factiii-auto.js");
+const secret_prompts_js_1 = require("../utils/secret-prompts.js");
+/**
+ * Check if ansible-vault CLI is available
+ */
+function checkAnsibleVault() {
+    try {
+        (0, child_process_1.execSync)('ansible-vault --version', { stdio: 'pipe' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function init(options = {}) {
+    const rootDir = options.rootDir ?? process.cwd();
+    console.log('Initializing Factiii Stack...\n');
+    const factiiiYmlPath = path.join(rootDir, 'factiii.yml');
+    const factiiiAutoYmlPath = path.join(rootDir, 'factiiiAuto.yml');
+    // Check if files exist and prompt if not using --force
+    let shouldCreateYml = options.force ?? false;
+    let shouldCreateAuto = options.force ?? false;
+    if (!fs.existsSync(factiiiYmlPath)) {
+        shouldCreateYml = true; // File doesn't exist, create it
+    }
+    else if (!options.force) {
+        shouldCreateYml = await (0, secret_prompts_js_1.confirm)('factiii.yml already exists. Overwrite it?', false);
+        if (!shouldCreateYml) {
+            console.log('Skipping factiii.yml');
+        }
+    }
+    if (!fs.existsSync(factiiiAutoYmlPath)) {
+        shouldCreateAuto = true; // File doesn't exist, create it
+    }
+    else if (!options.force) {
+        shouldCreateAuto = await (0, secret_prompts_js_1.confirm)('factiiiAuto.yml already exists. Overwrite it?', false);
+        if (!shouldCreateAuto) {
+            console.log('Skipping factiiiAuto.yml');
+        }
+    }
+    // Generate factiii.yml
+    if (shouldCreateYml) {
+        const created = (0, generate_factiii_yml_js_1.generateFactiiiYml)(rootDir, { force: true });
+        if (created) {
+            // Generate factiiiAuto.yml (always update if yml was created/updated)
+            await (0, generate_factiii_auto_js_1.generateFactiiiAuto)(rootDir, { force: shouldCreateAuto });
+        }
+    }
+    else {
+        // factiii.yml not created, but check if we should update factiiiAuto.yml
+        if (shouldCreateAuto) {
+            await (0, generate_factiii_auto_js_1.generateFactiiiAuto)(rootDir, { force: true });
+        }
+        else if (fs.existsSync(factiiiYmlPath)) {
+            // factiii.yml exists and wasn't overwritten, but auto might need updating
+            // (factiiiAuto.yml is auto-detected, so update if content changed)
+            await (0, generate_factiii_auto_js_1.generateFactiiiAuto)(rootDir, { force: false });
+        }
+        else {
+            console.log('\nNo configuration files to create.');
+        }
+    }
+    // Check prerequisites
+    console.log('\nChecking prerequisites...\n');
+    const hasAnsibleVault = checkAnsibleVault();
+    if (hasAnsibleVault) {
+        console.log('  [OK] ansible-vault is installed');
+    }
+    else {
+        console.log('  [!] ansible-vault not found');
+        console.log('      Ansible Vault is required for managing secrets.');
+        console.log('      Install:');
+        if (process.platform === 'darwin') {
+            console.log('        brew install ansible');
+        }
+        else if (process.platform === 'win32') {
+            console.log('        pip install ansible');
+        }
+        else {
+            console.log('        sudo apt install ansible  (Debian/Ubuntu)');
+            console.log('        sudo yum install ansible  (RHEL/CentOS)');
+        }
+    }
+    // Vault setup (only if ansible is available and we created a new config)
+    if (hasAnsibleVault && shouldCreateYml) {
+        const vaultPassFile = path.join(os.homedir(), '.vault_pass');
+        const hasExistingVaultPass = fs.existsSync(vaultPassFile);
+        if (hasExistingVaultPass) {
+            console.log('  [OK] Vault password file exists at ' + vaultPassFile);
+        }
+        else {
+            console.log('');
+            const setupVault = await (0, secret_prompts_js_1.confirm)('Set up Ansible Vault for secrets now?', true);
+            if (setupVault) {
+                console.log('\n  Create a vault password (keep this safe - you need it to access secrets):');
+                const vaultPassword = await (0, secret_prompts_js_1.promptSingleLine)('  Vault password: ');
+                if (vaultPassword && vaultPassword.trim().length > 0) {
+                    // Write vault password file
+                    fs.writeFileSync(vaultPassFile, vaultPassword.trim(), 'utf8');
+                    try {
+                        fs.chmodSync(vaultPassFile, 0o600);
+                    }
+                    catch {
+                        // Windows doesn't support chmod - that's OK
+                    }
+                    console.log('  [OK] Vault password saved to ' + vaultPassFile);
+                    // Create group_vars/all/ directory
+                    const groupVarsDir = path.join(rootDir, 'group_vars', 'all');
+                    if (!fs.existsSync(groupVarsDir)) {
+                        fs.mkdirSync(groupVarsDir, { recursive: true });
+                        console.log('  [OK] Created ' + groupVarsDir);
+                    }
+                    // Initialize vault file
+                    try {
+                        const { AnsibleVaultSecrets } = await Promise.resolve().then(() => __importStar(require('../utils/ansible-vault-secrets.js')));
+                        const vault = new AnsibleVaultSecrets({
+                            vault_path: 'group_vars/all/vault.yml',
+                            vault_password_file: '~/.vault_pass',
+                            rootDir,
+                        });
+                        await vault.setSecret('_initialized', 'true');
+                        console.log('  [OK] Created encrypted vault at group_vars/all/vault.yml');
+                    }
+                    catch (e) {
+                        const msg = e instanceof Error ? e.message : String(e);
+                        console.log('  [!] Failed to create vault: ' + msg);
+                        console.log('      You can set it up later with: npx factiii secrets set <KEY>');
+                    }
+                }
+                else {
+                    console.log('  [!] Skipped vault setup (no password provided)');
+                }
+            }
+            else {
+                console.log('  [!] Skipped vault setup. Set up later:');
+                console.log('      1. Create vault password: echo "your-password" > ~/.vault_pass');
+                console.log('      2. Store a secret: npx factiii secrets set STAGING_SSH');
+            }
+        }
+    }
+    console.log('');
+}
+exports.default = init;
+//# sourceMappingURL=init.js.map

package/dist/cli/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/cli/init.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBH,oBAiIC;AAtJD,2CAA6B;AAC7B,uCAAyB;AACzB,uCAAyB;AACzB,iDAAyC;AACzC,mFAA2E;AAC3E,qFAA6E;AAC7E,kEAAuE;AAGvE;;GAEG;AACH,SAAS,iBAAiB;IACxB,IAAI,CAAC;QACH,IAAA,wBAAQ,EAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACvD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,IAAI,CAAC,UAAuB,EAAE;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAEjD,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAE/C,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAEjE,uDAAuD;IACvD,IAAI,eAAe,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAC7C,IAAI,gBAAgB,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IAE9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACnC,eAAe,GAAG,IAAI,CAAC,CAAE,gCAAgC;IAC3D,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,eAAe,GAAG,MAAM,IAAA,2BAAO,EAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;QACpF,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACvC,gBAAgB,GAAG,IAAI,CAAC,CAAE,gCAAgC;IAC5D,CAAC;SAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1B,gBAAgB,GAAG,MAAM,IAAA,2BAAO,EAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,IAAA,4CAAkB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,OAAO,EAAE,CAAC;YACZ,sEAAsE;YACtE,MAAM,IAAA,8CAAmB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAA,8CAAmB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACzC,0EAA0E;YAC1E,mEAAmE;YACnE,MAAM,IAAA,8CAAmB,EAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAE7C,MAAM,eAAe,GAAG,iBAAiB,EAAE,CAAC;IAC5C,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;IACnD,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;YACjE,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IAAI,eAAe,IAAI,eAAe,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;QAC7D,MAAM,oBAAoB,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAE1D,IAAI,oBAAoB,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,uCAAuC,GAAG,aAAa,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,UAAU,GAAG,MAAM,IAAA,2BAAO,EAAC,uCAAuC,EAAE,IAAI,CAAC,CAAC;YAEhF,IAAI,UAAU,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,+EAA+E,CAAC,CAAC;gBAC7F,MAAM,aAAa,GAAG,MAAM,IAAA,oCAAgB,EAAC,oBAAoB,CAAC,CAAC;gBAEnE,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACrD,4BAA4B;oBAC5B,EAAE,CAAC,aAAa,CAAC,aAAa,EAAE,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;oBAC9D,IAAI,CAAC;wBACH,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;oBACrC,CAAC;oBAAC,MAAM,CAAC;wBACP,4CAA4C;oBAC9C,CAAC;oBACD,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,aAAa,CAAC,CAAC;oBAE/D,mCAAmC;oBACnC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;oBAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;wBACjC,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;wBAChD,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,YAAY,CAAC,CAAC;oBAChD,CAAC;oBAED,wBAAwB;oBACxB,IAAI,CAAC;wBACH,MAAM,EAAE,mBAAmB,EAAE,GAAG,wDAAa,mCAAmC,GAAC,CAAC;wBAClF,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC;4BACpC,UAAU,EAAE,0BAA0B;4BACtC,mBAAmB,EAAE,eAAe;4BACpC,OAAO;yBACR,CAAC,CAAC;wBACH,MAAM,KAAK,CAAC,SAAS,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;wBAC9C,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;oBAC5E,CAAC;oBAAC,OAAO,CAAC,EAAE,CAAC;wBACX,MAAM,GAAG,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;wBACvD,OAAO,CAAC,GAAG,CAAC,gCAAgC,GAAG,GAAG,CAAC,CAAC;wBACpD,OAAO,CAAC,GAAG,CAAC,mEAAmE,CAAC,CAAC;oBACnF,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;gBAClE,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;gBACxD,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;gBACpF,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,kBAAe,IAAI,CAAC"}

package/dist/cli/plugin-commands.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Plugin Commands Registration
+ *
+ * Discovers commands from pipeline plugins and registers them with Commander.
+ * Commands follow the stage routing pattern (local vs workflow).
+ */
+import type { Command } from 'commander';
+import type { PluginCommand, Stage, FactiiiConfig, Reachability } from '../types/index.js';
+/**
+ * Pipeline plugin class interface for commands
+ */
+interface PipelinePluginClass {
+    id: string;
+    commands?: PluginCommand[];
+    canReach(stage: Stage, config: FactiiiConfig): Reachability;
+}
+/**
+ * Register all commands from a pipeline plugin
+ */
+export declare function registerPluginCommands(program: Command, pipelinePlugin: PipelinePluginClass): void;
+export {};
+//# sourceMappingURL=plugin-commands.d.ts.map

package/dist/cli/plugin-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-commands.d.ts","sourceRoot":"","sources":["../../src/cli/plugin-commands.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,EACV,aAAa,EACb,KAAK,EACL,aAAa,EACb,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAE3B;;GAEG;AACH,UAAU,mBAAmB;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,aAAa,EAAE,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,GAAG,YAAY,CAAC;CAC7D;AAsCD;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,cAAc,EAAE,mBAAmB,GAClC,IAAI,CAsDN"}

package/dist/cli/plugin-commands.js

@@ -0,0 +1,121 @@
+"use strict";
+/**
+ * Plugin Commands Registration
+ *
+ * Discovers commands from pipeline plugins and registers them with Commander.
+ * Commands follow the stage routing pattern (local vs workflow).
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerPluginCommands = registerPluginCommands;
+/**
+ * Register a single command under a parent
+ */
+function registerCommand(parent, cmd, pipelinePlugin) {
+    const subCmd = parent
+        .command(cmd.name)
+        .description(cmd.description)
+        .option('--dev', 'Run on dev environment')
+        .option('--staging', 'Run on staging environment')
+        .option('--prod', 'Run on production environment');
+    // Add --force flag for destructive commands
+    if (cmd.prodSafety === 'destructive') {
+        subCmd.option('--force', 'Force execution on production (required for destructive commands)');
+    }
+    // Add command-specific options
+    for (const opt of cmd.options ?? []) {
+        if (opt.defaultValue !== undefined) {
+            subCmd.option(opt.flags, opt.description, opt.defaultValue);
+        }
+        else {
+            subCmd.option(opt.flags, opt.description);
+        }
+    }
+    // Action handler
+    subCmd.action(async (options) => {
+        const { executePluginCommand } = await Promise.resolve().then(() => __importStar(require('./execute-plugin-command.js')));
+        await executePluginCommand(cmd, options, pipelinePlugin);
+    });
+}
+/**
+ * Register all commands from a pipeline plugin
+ */
+function registerPluginCommands(program, pipelinePlugin) {
+    const commands = pipelinePlugin.commands ?? [];
+    if (commands.length === 0) {
+        return;
+    }
+    // Group commands by category
+    const byCategory = new Map();
+    for (const cmd of commands) {
+        const existing = byCategory.get(cmd.category) ?? [];
+        existing.push(cmd);
+        byCategory.set(cmd.category, existing);
+    }
+    // Register 'db' subcommand group
+    const dbCommands = byCategory.get('db');
+    if (dbCommands && dbCommands.length > 0) {
+        const cmdNames = dbCommands.map(c => c.name).join(', ');
+        const dbCmd = program
+            .command('db')
+            .description('Database operations (' + cmdNames + ')');
+        for (const cmd of dbCommands) {
+            registerCommand(dbCmd, cmd, pipelinePlugin);
+        }
+    }
+    // Register 'ops' subcommand group
+    const opsCommands = byCategory.get('ops');
+    if (opsCommands && opsCommands.length > 0) {
+        const cmdNames = opsCommands.map(c => c.name).join(', ');
+        const opsCmd = program
+            .command('ops')
+            .description('Server operations (' + cmdNames + ')');
+        for (const cmd of opsCommands) {
+            registerCommand(opsCmd, cmd, pipelinePlugin);
+        }
+    }
+    // Register 'backup' subcommand group
+    const backupCommands = byCategory.get('backup');
+    if (backupCommands && backupCommands.length > 0) {
+        const cmdNames = backupCommands.map(c => c.name).join(', ');
+        const backupCmd = program
+            .command('backup')
+            .description('Backup operations (' + cmdNames + ')');
+        for (const cmd of backupCommands) {
+            registerCommand(backupCmd, cmd, pipelinePlugin);
+        }
+    }
+}
+//# sourceMappingURL=plugin-commands.js.map

package/dist/cli/plugin-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-commands.js","sourceRoot":"","sources":["../../src/cli/plugin-commands.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2DH,wDAyDC;AAhGD;;GAEG;AACH,SAAS,eAAe,CACtB,MAAe,EACf,GAAkB,EAClB,cAAmC;IAEnC,MAAM,MAAM,GAAG,MAAM;SAClB,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;SACjB,WAAW,CAAC,GAAG,CAAC,WAAW,CAAC;SAC5B,MAAM,CAAC,OAAO,EAAE,wBAAwB,CAAC;SACzC,MAAM,CAAC,WAAW,EAAE,4BAA4B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC;IAErD,4CAA4C;IAC5C,IAAI,GAAG,CAAC,UAAU,KAAK,aAAa,EAAE,CAAC;QACrC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,mEAAmE,CAAC,CAAC;IAChG,CAAC;IAED,+BAA+B;IAC/B,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACpC,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,EAAE,oBAAoB,EAAE,GAAG,wDAAa,6BAA6B,GAAC,CAAC;QAC7E,MAAM,oBAAoB,CAAC,GAAG,EAAE,OAAO,EAAE,cAAc,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAgB,sBAAsB,CACpC,OAAgB,EAChB,cAAmC;IAEnC,MAAM,QAAQ,GAAG,cAAc,CAAC,QAAQ,IAAI,EAAE,CAAC;IAE/C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,6BAA6B;IAC7B,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoC,CAAC;IAE/D,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnB,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,iCAAiC;IACjC,MAAM,UAAU,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,KAAK,GAAG,OAAO;aAClB,OAAO,CAAC,IAAI,CAAC;aACb,WAAW,CAAC,uBAAuB,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEzD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,eAAe,CAAC,KAAK,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,kCAAkC;IAClC,MAAM,WAAW,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC1C,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,OAAO;aACnB,OAAO,CAAC,KAAK,CAAC;aACd,WAAW,CAAC,qBAAqB,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEvD,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;YAC9B,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,qCAAqC;IACrC,MAAM,cAAc,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAChD,IAAI,cAAc,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO;aACtB,OAAO,CAAC,QAAQ,CAAC;aACjB,WAAW,CAAC,qBAAqB,GAAG,QAAQ,GAAG,GAAG,CAAC,CAAC;QAEvD,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YACjC,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/cli/scan.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Scan Command
+ *
+ * Runs scan side of all plugin fixes.
+ * Returns problems found (which are the fixes that need to run).
+ *
+ * Usage:
+ *   npx factiii scan           # Scan all stages
+ *   npx factiii scan --dev     # Scan dev only
+ *   npx factiii scan --staging # Scan staging only
+ *   npx factiii scan --prod    # Scan prod only
+ *
+ * ============================================================
+ * STAGE EXECUTION PATTERN - DO NOT MODIFY WITHOUT READING
+ * ============================================================
+ *
+ * How this works:
+ *
+ * 1. User specifies stage: --dev, --secrets, --staging, --prod
+ *    Or no flag = all stages in order
+ *
+ * 2. This file groups all plugin fixes by their stage property
+ *
+ * 3. For each requested stage, asks PIPELINE PLUGIN: canReach(stage)?
+ *    - { reachable: true, via: 'local' } → run fixes locally
+ *    - { reachable: true, via: 'workflow' } → pipeline triggers workflow
+ *    - { reachable: false, reason: '...' } → show error, stop
+ *
+ * CRITICAL: This file does NOT know about:
+ *   - GITHUB_TOKEN (that's pipeline plugin's concern)
+ *   - SSH keys (that's pipeline plugin's concern)
+ *   - How to trigger workflows (that's pipeline plugin's concern)
+ *
+ * This file ONLY:
+ *   - Collects fixes from all plugins
+ *   - Groups them by stage
+ *   - Asks pipeline if each stage is reachable
+ *   - Runs fixes for reachable stages
+ *
+ * This keeps scan.ts compatible with ANY pipeline plugin.
+ *
+ * ============================================================
+ * FOR PIPELINE PLUGIN AUTHORS:
+ * ============================================================
+ *
+ * When your workflow/CI SSHs to a server, you MUST call the
+ * command with the specific stage flag:
+ *
+ *   npx factiii fix --staging    # NOT just "npx factiii fix"
+ *   npx factiii scan --prod      # NOT just "npx factiii scan"
+ *
+ * Without the stage flag, the command will try to run ALL stages
+ * and may try to trigger workflows for stages it can't reach.
+ *
+ * Your canReach() should return 'local' when running on the
+ * target server (e.g., check GITHUB_ACTIONS or CI env vars).
+ *
+ * ============================================================
+ */
+import type { ScanOptions, ScanProblems } from '../types/index.js';
+/**
+ * Main scan function
+ */
+export declare function scan(options?: ScanOptions): Promise<ScanProblems>;
+export default scan;
+//# sourceMappingURL=scan.d.ts.map

package/dist/cli/scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan.d.ts","sourceRoot":"","sources":["../../src/cli/scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAQH,OAAO,KAAK,EAA2C,WAAW,EAAE,YAAY,EAAY,MAAM,mBAAmB,CAAC;AAwTtH;;GAEG;AACH,wBAAsB,IAAI,CAAC,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CA2J3E;AAED,eAAe,IAAI,CAAC"}