@intentic/cli 1.0.2

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,80 @@
+# @intentic/cli
+
+The **runnable product** — the `intentic` CLI (`bin: intentic`). It turns a local intent file into a
+desired-state artifact and executes it, with no remote control plane required. Depends on
+`@intentic/engine`, `@intentic/providers`, `@intentic/need-resolver`, `@intentic/state-resolver`, `@intentic/graph`.
+
+## Local control plane
+
+The "control plane" is two local git repos: an **intent** repo holding `deploy.config.ts`, and a
+**desired-state** repo holding the generated artifact (`desired-state.json`) and the
+execution record (`status.json`). `intentic init` scaffolds both.
+
+## Commands
+
+Built on [stricli](https://github.com/bloomberg/stricli) with generated `--help` / `--version`.
+
+- `intentic init [--dir .]` — scaffold the `intent` and `desired-state` git repos (intent seeded
+  with a starter `deploy.config.ts`).
+- `intentic resolve [--config deploy.config.ts] [--out desired-state.json]` —
+  load the intent, resolve it to a `DesiredStateGraph`, and write it, along with `.env.example` (the
+  user-supplied secrets) and `.secrets.json` (the intentic-generated ones). No infra access.
+- `intentic plan [--artifact desired-state.json]` — read-only preview of what `apply` would
+  create/update.
+- `intentic apply [--artifact desired-state.json] [--max-iterations 5]` — reconcile the artifact
+  until state reads true, writing `status.json` beside it. Reads user-supplied secrets from `.env`
+  beside the artifact (or the environment) and generates the platform admin secrets it owns (see
+  below). On success it prints an **Access** summary and writes `access.md` beside the artifact: the
+  URL, the `intentic` username, and the password (the generated value on stdout; a pointer to
+  `.secrets.json` in the committed `access.md`) for Forgejo and Komodo, plus each app-environment URL.
+
+## Secrets
+
+Secrets split by who provides them:
+
+- **User-supplied** (`source: env`) — credentials to systems intentic does **not** create:
+  `HOST_SSH_KEY`, `CLOUDFLARE_API_TOKEN`, and each environment's `*_DATABASE_URL`. You set these in
+  `.env` beside the artifact (or the ambient environment). The required set is more than what your
+  `deploy.config.ts` names, so `resolve` derives it from the graph and writes `desired-state/.env.example`.
+- **intentic-generated** (`source: generated`) — admin credentials for the services intentic itself
+  provisions: `FORGEJO_ADMIN_PASSWORD`, `KOMODO_ADMIN_PASSWORD`, `KOMODO_WEBHOOK_SECRET`. `resolve`
+  generates each one (shell-safe hex) the first time and persists it to gitignored
+  `desired-state/.secrets.json`, reusing it forever after (`plan`/`apply` reuse it too; Forgejo/Komodo
+  bake the password in on first init and won't re-key, so it must be stable). intentic **owns** this
+  file — it's authoritative, so put platform keys here, not in `.env`; to pin your own value, edit
+  `.secrets.json`. The Forgejo/Komodo password is what you log in with, as user `intentic`.
+
+Both `.env` and `.secrets.json` are gitignored, so no secret lands in the PR-managed repo.
+
+## Workflow
+
+```sh
+intentic init
+cd intent && intentic resolve --out ../desired-state/desired-state.json
+cp ../desired-state/.env.example ../desired-state/.env   # fill in the user-supplied values resolve listed
+cd .. && intentic apply                                  # generates the platform secrets, prints the logins
+```
+
+> A `deploy.config.ts` imports `@intentic/sdk` + `@intentic/graph`, so the project it lives in must have
+> them installed. `apply` reconciles the per-host platform (Forgejo/Komodo/runner, Cloudflare tunnel + DNS)
+> as ordinary nodes in the artifact — a future "PR-managed" phase (a remote Forgejo watching the intent
+> repo) would layer on top of this same flow.
+
+## Key files
+
+- [src/cli.ts](src/cli.ts) / [src/app.ts](src/app.ts) — the stricli app and command wiring.
+- [src/init.ts](src/init.ts) / [src/resolve.ts](src/resolve.ts) / [src/apply.ts](src/apply.ts) — the `init`/`resolve`/`apply` commands (plan lives alongside resolve/apply).
+- [src/artifact.ts](src/artifact.ts) — `readArtifact`/`writeArtifact`/`writeStatus` (the desired-state files).
+- [src/secrets.ts](src/secrets.ts) / [src/generated-secrets.ts](src/generated-secrets.ts) — the user-supplied vs intentic-generated secret split.
+- [src/output.ts](src/output.ts) — honors `INTENTIC_OUTPUT` (`text`/`json`/`ndjson`); maps `EngineEvent`s to the chosen format.
+- [src/adopt.ts](src/adopt.ts) / [src/adopt-pipelines.ts](src/adopt-pipelines.ts) — push the intent/desired-state repos into Forgejo + wire Actions.
+- [src/access.ts](src/access.ts) — the post-apply Access summary + `access.md`; [src/known-hosts.ts](src/known-hosts.ts) — TOFU host-key pinning.
+
+## Conventions
+
+- Runs the engine as the **only** place providers are constructed (via `createProviders`); it owns reading `.env` and generating `.secrets.json`.
+- Subprocess-friendly: a backend can drive it and parse `INTENTIC_OUTPUT=ndjson`/`json` instead of scraping prose (the platform's `provision.ts` does exactly this).
+- Co-located unit tests + a gated [src/cli.e2e.test.ts](src/cli.e2e.test.ts) (real infra, opt-in).
+
+**Key exports:** `loadIntent`; `readArtifact` / `writeArtifact` / `writeStatus`; `scaffold`; the
+`CONFIG_FILE` / `ARTIFACT_FILE` / `STATUS_FILE` constants. See [ARCHITECTURE.md](../../ARCHITECTURE.md).

package/dist/add-app/add-app.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const addAppCommand: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=add-app.command.d.ts.map

package/dist/add-app/add-app.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-app.command.d.ts","sourceRoot":"","sources":["../../src/add-app/add-app.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AA8BlE,eAAO,MAAM,aAAa,iDAiCxB,CAAC"}

package/dist/add-app/add-app.command.js

@@ -0,0 +1,50 @@
+import { addAppsToMonorepo, DEFAULT_TEMPLATE_REF, DEFAULT_TEMPLATE_SOURCE } from "@intentic/scaffold";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { createOutput } from "../lib/output.js";
+const parseApps = (raw) => raw
+    .split(",")
+    .map((entry) => entry.trim())
+    .filter(Boolean)
+    .map((entry) => {
+    const colon = entry.indexOf(":");
+    if (colon === -1) {
+        return { template: entry, name: entry };
+    }
+    return { template: entry.slice(0, colon), name: entry.slice(colon + 1) };
+});
+export const addAppCommand = buildCommand({
+    docs: { brief: "Add one or more app instances into an existing monorepo at <dir>" },
+    parameters: {
+        flags: {
+            dir: { kind: "parsed", parse: String, brief: "The monorepo repo directory to add the apps into" },
+            apps: {
+                kind: "parsed",
+                parse: String,
+                brief: "Comma-separated entries: template key or template:name, e.g. api,web:shop-web,api:admin-api",
+            },
+            source: { kind: "parsed", parse: String, optional: true, brief: `Template source git URL (default: ${DEFAULT_TEMPLATE_SOURCE})` },
+            ref: { kind: "parsed", parse: String, optional: true, brief: `Template source branch/tag (default: ${DEFAULT_TEMPLATE_REF})` },
+        },
+    },
+    async func(flags) {
+        const out = createOutput(this.process.stdout, loadConfig().intenticOutput);
+        const apps = parseApps(flags.apps);
+        if (apps.length === 0) {
+            throw new Error("no apps specified — pass --apps api,web:shop-web");
+        }
+        const progress = addAppsToMonorepo({
+            repoDir: flags.dir,
+            source: flags.source ?? DEFAULT_TEMPLATE_SOURCE,
+            ref: flags.ref ?? DEFAULT_TEMPLATE_REF,
+            apps,
+        });
+        for await (const message of progress) {
+            out.text(message);
+        }
+        const labels = apps.map((a) => (a.name === a.template ? a.template : `${a.template}:${a.name}`));
+        out.text(`added ${labels.join(", ")} to ${flags.dir}`);
+        out.result({ dir: flags.dir, apps });
+    },
+});
+//# sourceMappingURL=add-app.command.js.map

package/dist/add-app/add-app.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"add-app.command.js","sourceRoot":"","sources":["../../src/add-app/add-app.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,uBAAuB,EAAyB,MAAM,oBAAoB,CAAC;AAC7H,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAYhD,MAAM,SAAS,GAAG,CAAC,GAAW,EAAsB,EAAE,CAClD,GAAG;KACE,KAAK,CAAC,GAAG,CAAC;KACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;KAC5B,MAAM,CAAC,OAAO,CAAC;KACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;IACX,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;AAC7E,CAAC,CAAC,CAAC;AAKX,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAc;IACnD,IAAI,EAAE,EAAE,KAAK,EAAE,kEAAkE,EAAE;IACnF,UAAU,EAAE;QACR,KAAK,EAAE;YACH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,kDAAkD,EAAE;YACjG,IAAI,EAAE;gBACF,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,6FAA6F;aACvG;YACD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,qCAAqC,uBAAuB,GAAG,EAAE;YACjI,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,wCAAwC,oBAAoB,GAAG,EAAE;SACjI;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAkB;QAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC;YAC/B,OAAO,EAAE,KAAK,CAAC,GAAG;YAClB,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,uBAAuB;YAC/C,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,oBAAoB;YACtC,IAAI;SACP,CAAC,CAAC;QACH,IAAI,KAAK,EAAE,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YACnC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACjG,GAAG,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACvD,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;CACJ,CAAC,CAAC"}

package/dist/adopt/adopt.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const adopt: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=adopt.command.d.ts.map

package/dist/adopt/adopt.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.command.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAkBlE,eAAO,MAAM,KAAK,iDAkFhB,CAAC"}

package/dist/adopt/adopt.command.js

@@ -0,0 +1,77 @@
+import { dirname, join } from "node:path";
+import { forgejoApi } from "@intentic/providers";
+import { secretDigest, writeSyncState } from "@intentic/scaffold";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_FILE, ARTIFACT_PATH, CONFIG_FILE, INTENT_DIR, loadEnvFile, readArtifact, TARGET_DIR } from "../lib/artifact.js";
+import { createOutput } from "../lib/output.js";
+import { withRunLog } from "../lib/run-log.js";
+import { version } from "../lib/version.js";
+import { collectSecretValues, GIT_TOKEN_SECRET, GIT_USER_SECRET, setRepoSecrets, writeControlPlaneWorkflows, } from "../pipelines/adopt-pipelines.js";
+import { forgejoIdentity } from "../pipelines/control-plane-sync.js";
+import { readGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { adoptRepos } from "./adopt.js";
+export const adopt = buildCommand({
+    docs: { brief: "Push the local intent and desired-state repos to the provisioned Forgejo" },
+    parameters: {
+        flags: { artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` } },
+    },
+    async func(flags) {
+        const out = createOutput(withRunLog(this.process.stdout, "adopt"), loadConfig().intenticOutput);
+        const artifact = flags.artifact ?? ARTIFACT_PATH;
+        const targetDir = dirname(artifact);
+        const intentDir = join(dirname(targetDir), INTENT_DIR);
+        loadEnvFile(targetDir);
+        const graph = await readArtifact(artifact);
+        if (!Object.values(graph.resources).some((node) => node.type === "forgejo")) {
+            out.text("no forgejo in the artifact (no control plane) — nothing to adopt");
+            out.result({ repos: [], reason: "no control plane" });
+            return;
+        }
+        const { domain, user, adminPasswordRef: ref } = forgejoIdentity(graph);
+        const generatedValues = await readGeneratedSecrets(targetDir);
+        const password = ref.source === "generated" ? generatedValues[ref.key] : process.env[ref.key];
+        if (password === undefined || password === "") {
+            throw new Error(`forgejo admin password (${ref.source} secret ${ref.key}) is not available`);
+        }
+        const desiredStateSecrets = collectSecretValues(graph, process.env, generatedValues);
+        const inputs = {
+            cliVersion: version,
+            user,
+            domain,
+            configFile: CONFIG_FILE,
+            artifactFile: ARTIFACT_FILE,
+            intentRepo: INTENT_DIR,
+            desiredStateRepo: TARGET_DIR,
+            applySecretKeys: Object.keys(desiredStateSecrets).toSorted(),
+            forgejoPasswordKey: ref.key,
+        };
+        await writeControlPlaneWorkflows(intentDir, targetDir, inputs);
+        const baseUrl = `https://${domain}`;
+        const repos = await adoptRepos({
+            baseUrl,
+            user,
+            password,
+            repos: [
+                { dir: intentDir, name: INTENT_DIR },
+                { dir: targetDir, name: TARGET_DIR },
+            ],
+            log: out.log,
+        });
+        const intentSecrets = { [GIT_USER_SECRET]: user, [GIT_TOKEN_SECRET]: password };
+        if (desiredStateSecrets["CLOUDFLARE_API_TOKEN"] !== undefined) {
+            intentSecrets["CLOUDFLARE_API_TOKEN"] = desiredStateSecrets["CLOUDFLARE_API_TOKEN"];
+        }
+        await setRepoSecrets({ api: forgejoApi, baseUrl, user, password, owner: user, name: INTENT_DIR, secrets: intentSecrets });
+        await setRepoSecrets({ api: forgejoApi, baseUrl, user, password, owner: user, name: TARGET_DIR, secrets: desiredStateSecrets });
+        const pushedAt = new Date().toISOString();
+        await writeSyncState(targetDir, Object.fromEntries(Object.entries(desiredStateSecrets).map(([key, value]) => [key, { digest: secretDigest(value), pushedAt }])));
+        out.text(`set ${Object.keys(intentSecrets).length} secret(s) on ${user}/${INTENT_DIR}, ${Object.keys(desiredStateSecrets).length} on ${user}/${TARGET_DIR}`);
+        out.result({
+            repos,
+            intentSecrets: Object.keys(intentSecrets).toSorted(),
+            desiredStateSecrets: Object.keys(desiredStateSecrets).toSorted(),
+        });
+    },
+});
+//# sourceMappingURL=adopt.command.js.map

package/dist/adopt/adopt.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.command.js","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EAEf,cAAc,EACd,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAAwB;IACrD,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE,EAAE;KACpI;IACD,KAAK,CAAC,IAAI,CAAuB,KAA4B;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,kEAAkE,CAAC,CAAC;YAC7E,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvE,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QACjG,CAAC;QAKD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAErF,MAAM,MAAM,GAAmB;YAC3B,UAAU,EAAE,OAAO;YACnB,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,UAAU;YACtB,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;YAC5D,kBAAkB,EAAE,GAAG,CAAC,GAAG;SAC9B,CAAC;QAEF,MAAM,0BAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,WAAW,MAAM,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;YAC3B,OAAO;YACP,IAAI;YACJ,QAAQ;YACR,KAAK,EAAE;gBACH,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;gBACpC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;aACvC;YACD,GAAG,EAAE,GAAG,CAAC,GAAG;SACf,CAAC,CAAC;QAIH,MAAM,aAAa,GAA2B,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;QACxG,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,aAAa,CAAC,sBAAsB,CAAC,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;QAC1H,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAGhI,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,cAAc,CAChB,SAAS,EACT,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAClI,CAAC;QACF,GAAG,CAAC,IAAI,CACJ,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,iBAAiB,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,OAAO,IAAI,IAAI,UAAU,EAAE,CACrJ,CAAC;QACF,GAAG,CAAC,MAAM,CAAC;YACP,KAAK;YACL,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;YACpD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}

package/dist/adopt/adopt.d.ts

@@ -0,0 +1,21 @@
+import type { ForgejoApi } from "@intentic/providers";
+import { type GitRunner } from "@intentic/scaffold";
+export type { GitRunner };
+export interface AdoptRepo {
+    readonly dir: string;
+    readonly name: string;
+}
+export interface AdoptOptions {
+    readonly baseUrl: string;
+    readonly user: string;
+    readonly password: string;
+    readonly repos: readonly AdoptRepo[];
+    readonly log: (message: string) => void;
+    readonly api?: ForgejoApi;
+    readonly git?: GitRunner;
+}
+export declare const adoptRepos: (options: AdoptOptions) => Promise<{
+    readonly name: string;
+    readonly cloneUrl: string;
+}[]>;
+//# sourceMappingURL=adopt.d.ts.map

package/dist/adopt/adopt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEhE,YAAY,EAAE,SAAS,EAAE,CAAC;AAE1B,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;CAC5B;AAKD,eAAO,MAAM,UAAU,GAAU,SAAS,YAAY,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CA4BtH,CAAC"}

package/dist/adopt/adopt.js

@@ -0,0 +1,31 @@
+import { forgejoApi } from "@intentic/providers";
+import { defaultGit } from "@intentic/scaffold";
+export const adoptRepos = async (options) => {
+    const api = options.api ?? forgejoApi;
+    const git = options.git ?? defaultGit;
+    const { baseUrl, user, password, repos, log } = options;
+    const email = `${user}@${new URL(baseUrl).host}`;
+    const authHeader = `AUTHORIZATION: basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
+    const pushed = [];
+    for (const { dir, name } of repos) {
+        const existing = await api.findRepo({ baseUrl, user, password, owner: user, name });
+        if (existing === undefined) {
+            await api.createRepo({ baseUrl, user, password, owner: user, ownerIsOrg: false, name, private: true, autoInit: false });
+            log(`created ${user}/${name} in Forgejo`);
+        }
+        await git(dir, ["add", "-A"]);
+        const status = await git(dir, ["status", "--porcelain"]);
+        if (status.stdout.trim() !== "") {
+            await git(dir, ["-c", `user.name=${user}`, "-c", `user.email=${email}`, "commit", "-m", "intentic adopt"]);
+        }
+        await git(dir, ["branch", "-M", "main"]);
+        const cloneUrl = `${baseUrl}/${user}/${name}.git`;
+        const remotes = (await git(dir, ["remote"])).stdout.split("\n").map((line) => line.trim());
+        await git(dir, remotes.includes("origin") ? ["remote", "set-url", "origin", cloneUrl] : ["remote", "add", "origin", cloneUrl]);
+        await git(dir, ["-c", `http.extraHeader=${authHeader}`, "push", "-u", "origin", "main"]);
+        log(`pushed ${dir} → ${cloneUrl}`);
+        pushed.push({ name, cloneUrl });
+    }
+    return pushed;
+};
+//# sourceMappingURL=adopt.js.map

package/dist/adopt/adopt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAkB,MAAM,oBAAoB,CAAC;AAwBhE,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAqB,EAAmE,EAAE;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACxD,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IACnG,MAAM,MAAM,GAAyC,EAAE,CAAC;IACxD,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxH,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;QACzD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC9B,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,aAAa,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC/G,CAAC;QAED,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACzC,MAAM,QAAQ,GAAG,GAAG,OAAO,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC;QAClD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/H,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB,UAAU,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,GAAG,CAAC,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/app.d.ts

@@ -0,0 +1,2 @@
+export declare const app: import("@stricli/core").Application<import("@stricli/core").CommandContext>;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AA8BA,eAAO,MAAM,GAAG,6EAyBf,CAAC"}

package/dist/app.js

@@ -0,0 +1,46 @@
+import { buildApplication, buildRouteMap, text_en } from "@stricli/core";
+import { addAppCommand } from "./add-app/add-app.command.js";
+import { adopt } from "./adopt/adopt.command.js";
+import { apply } from "./apply/apply.command.js";
+import { deploymentsCommand } from "./deployments/deployments.command.js";
+import { loadConfig } from "./env.config.js";
+import { hostSshTunnel } from "./host-ssh-tunnel/host-ssh-tunnel.command.js";
+import { init } from "./init/init.command.js";
+import { version } from "./lib/version.js";
+import { logsCommand } from "./logs/logs.command.js";
+import { monorepoCommand } from "./monorepo/monorepo.command.js";
+import { planCommand } from "./plan/plan.command.js";
+import { resolveCommand } from "./resolve/resolve.command.js";
+import { restore } from "./restore/restore.command.js";
+import { sandboxTunnel } from "./sandbox-tunnel/sandbox-tunnel.command.js";
+import { secretsCommand } from "./secrets/secrets.command.js";
+const formatException = (exc) => {
+    if (exc instanceof Error) {
+        return loadConfig().intenticDebug ? (exc.stack ?? exc.message) : exc.message;
+    }
+    return String(exc);
+};
+export const app = buildApplication(buildRouteMap({
+    routes: {
+        init,
+        monorepo: monorepoCommand,
+        addApp: addAppCommand,
+        resolve: resolveCommand,
+        plan: planCommand,
+        apply,
+        adopt,
+        restore,
+        secrets: secretsCommand,
+        deployments: deploymentsCommand,
+        logs: logsCommand,
+        sandboxTunnel,
+        hostSshTunnel,
+    },
+    docs: { brief: "intentic — intent-driven deployment" },
+}), {
+    name: "intentic",
+    versionInfo: { currentVersion: version },
+    scanner: { caseStyle: "allow-kebab-for-camel" },
+    localization: { loadText: (locale) => (locale.startsWith("en") ? { ...text_en, formatException } : undefined) },
+});
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,0BAA0B,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,8CAA8C,CAAC;AAC7E,OAAO,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,4CAA4C,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAM9D,MAAM,eAAe,GAAG,CAAC,GAAY,EAAU,EAAE;IAC7C,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACvB,OAAO,UAAU,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;IACjF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,GAAG,GAAG,gBAAgB,CAC/B,aAAa,CAAC;IACV,MAAM,EAAE;QACJ,IAAI;QACJ,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,cAAc;QACvB,IAAI,EAAE,WAAW;QACjB,KAAK;QACL,KAAK;QACL,OAAO;QACP,OAAO,EAAE,cAAc;QACvB,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,WAAW;QACjB,aAAa;QACb,aAAa;KAChB;IACD,IAAI,EAAE,EAAE,KAAK,EAAE,qCAAqC,EAAE;CACzD,CAAC,EACF;IACI,IAAI,EAAE,UAAU;IAChB,WAAW,EAAE,EAAE,cAAc,EAAE,OAAO,EAAE;IACxC,OAAO,EAAE,EAAE,SAAS,EAAE,uBAAuB,EAAE;IAC/C,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;CAClH,CACJ,CAAC"}

package/dist/apply/access.d.ts

@@ -0,0 +1,16 @@
+import { type DesiredStateGraph, type SecretSource } from "@intentic/graph";
+export interface AccessEntry {
+    readonly id: string;
+    readonly label: string;
+    readonly url: string;
+    readonly username?: string;
+    readonly password?: {
+        readonly source: SecretSource;
+        readonly key: string;
+        readonly value?: string;
+    };
+}
+export declare const collectAccess: (graph: DesiredStateGraph, outputs: Readonly<Record<string, Readonly<Record<string, unknown>>>>, env: Readonly<Record<string, string | undefined>>) => AccessEntry[];
+export declare const formatAccessSummary: (entries: readonly AccessEntry[]) => string;
+export declare const writeAccessFile: (path: string, entries: readonly AccessEntry[]) => Promise<void>;
+//# sourceMappingURL=access.d.ts.map

package/dist/apply/access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/apply/access.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,iBAAiB,EAAa,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAgBvF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxG;AAKD,eAAO,MAAM,aAAa,GACtB,OAAO,iBAAiB,EACxB,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EACpE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAClD,WAAW,EAuBb,CAAC;AAeF,eAAO,MAAM,mBAAmB,GAAI,SAAS,SAAS,WAAW,EAAE,KAAG,MASrE,CAAC;AAWF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,SAAS,SAAS,WAAW,EAAE,KAAG,OAAO,CAAC,IAAI,CAMjG,CAAC"}

package/dist/apply/access.js

@@ -0,0 +1,72 @@
+import { writeFile } from "node:fs/promises";
+import { secretRef } from "@intentic/graph";
+import { renderTemplate } from "../lib/templates.js";
+const SERVICE_LABELS = {
+    forgejo: "Forgejo (git)",
+    komodo: "Komodo (deploys)",
+    signoz: "SignOz (observability)",
+    outline: "Outline (wiki)",
+    paperless: "Paperless-ngx (documents)",
+    openproject: "OpenProject (projects)",
+    invoiceninja: "Invoice Ninja (invoicing)",
+    infisical: "Infisical (secrets)",
+};
+export const collectAccess = (graph, outputs, env) => {
+    const entries = [];
+    for (const node of Object.values(graph.resources)) {
+        if (node.type !== "deployment" && SERVICE_LABELS[node.type] === undefined) {
+            continue;
+        }
+        const url = outputs[node.id]?.["url"];
+        if (typeof url !== "string") {
+            continue;
+        }
+        const username = node.inputs["adminUser"];
+        const ref = secretRef(node.inputs["adminPassword"]);
+        const value = ref?.source === "generated" ? env[ref.key] : undefined;
+        const password = ref === undefined ? undefined : { source: ref.source, key: ref.key, ...(value !== undefined ? { value } : {}) };
+        entries.push({
+            id: node.id,
+            label: SERVICE_LABELS[node.type] ?? node.id,
+            url,
+            ...(typeof username === "string" ? { username } : {}),
+            ...(password !== undefined ? { password } : {}),
+        });
+    }
+    return entries;
+};
+const summaryPassword = (password) => {
+    if (password === undefined) {
+        return "";
+    }
+    if (password.source === "generated") {
+        return password.value !== undefined
+            ? `   password: ${password.value}  (saved in .secrets.json)`
+            : "   password: (generated — see .secrets.json)";
+    }
+    return `   password: $${password.key}`;
+};
+export const formatAccessSummary = (entries) => {
+    const lines = ["", "Access:"];
+    for (const entry of entries) {
+        lines.push(`  ${entry.label}  ${entry.url}`);
+        if (entry.username !== undefined) {
+            lines.push(`    user: ${entry.username}${summaryPassword(entry.password)}`);
+        }
+    }
+    return lines.join("\n");
+};
+const markdownPassword = (password) => {
+    if (password === undefined) {
+        return "";
+    }
+    return password.source === "generated" ? "generated (see `.secrets.json`)" : `\`$${password.key}\``;
+};
+export const writeAccessFile = async (path, entries) => {
+    const services = entries
+        .filter((entry) => entry.username !== undefined)
+        .map((entry) => ({ label: entry.label, url: entry.url, username: entry.username, password: markdownPassword(entry.password) }));
+    const apps = entries.filter((entry) => entry.username === undefined).map((entry) => ({ id: entry.id, url: entry.url }));
+    await writeFile(path, renderTemplate("access.md", { services, apps }));
+};
+//# sourceMappingURL=access.js.map

package/dist/apply/access.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.js","sourceRoot":"","sources":["../../src/apply/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAA0B,SAAS,EAAqB,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,MAAM,cAAc,GAAqC;IACrD,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,wBAAwB;IAChC,OAAO,EAAE,gBAAgB;IACzB,SAAS,EAAE,2BAA2B;IACtC,WAAW,EAAE,wBAAwB;IACrC,YAAY,EAAE,2BAA2B;IACzC,SAAS,EAAE,qBAAqB;CACnC,CAAC;AAeF,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,KAAwB,EACxB,OAAoE,EACpE,GAAiD,EACpC,EAAE;IACf,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACxE,SAAS;QACb,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjI,OAAO,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAC3C,GAAG;YACH,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAGF,MAAM,eAAe,GAAG,CAAC,QAAiC,EAAU,EAAE;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC/B,CAAC,CAAC,gBAAgB,QAAQ,CAAC,KAAK,4BAA4B;YAC5D,CAAC,CAAC,8CAA8C,CAAC;IACzD,CAAC;IACD,OAAO,iBAAiB,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAA+B,EAAU,EAAE;IAC3E,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAIF,MAAM,gBAAgB,GAAG,CAAC,QAAiC,EAAU,EAAE;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC;AACxG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,OAA+B,EAAiB,EAAE;IAClG,MAAM,QAAQ,GAAG,OAAO;SACnB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC;SAC/C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACxH,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3E,CAAC,CAAC"}

package/dist/apply/apply-lock.d.ts

@@ -0,0 +1,12 @@
+import type { SshExecutor, SshTarget } from "@intentic/providers";
+export interface ApplyLock {
+    readonly verify: () => Promise<void>;
+    readonly renew: () => Promise<void>;
+    readonly release: () => Promise<void>;
+}
+export declare const acquireApplyLock: (executor: SshExecutor, targets: readonly SshTarget[], options?: {
+    readonly ttlSeconds?: number;
+    readonly holder?: string;
+    readonly log?: (message: string) => void;
+}) => Promise<ApplyLock>;
+//# sourceMappingURL=apply-lock.d.ts.map

package/dist/apply/apply-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-lock.d.ts","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAa,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAe7E,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAqED,eAAO,MAAM,gBAAgB,GACzB,UAAU,WAAW,EACrB,SAAS,SAAS,SAAS,EAAE,EAC7B,UAAS;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,KACnH,OAAO,CAAC,SAAS,CA4DnB,CAAC"}

package/dist/apply/apply-lock.js

@@ -0,0 +1,102 @@
+import { randomBytes } from "node:crypto";
+import { hostname } from "node:os";
+const LOCK_DIR = "/opt/intentic/apply.lock.d";
+const DEFAULT_TTL_SECONDS = 30 * 60;
+const lockKey = (target) => `${target.address}:${target.port}`;
+const orderedHosts = (targets) => {
+    const byKey = new Map();
+    for (const target of targets) {
+        byKey.set(lockKey(target), target);
+    }
+    return [...byKey.values()].toSorted((a, b) => lockKey(a).localeCompare(lockKey(b)));
+};
+const defaultHolder = () => `${hostname()}:${process.pid}`.replace(/[^A-Za-z0-9_.:@-]/g, "-");
+const header = (op, nonce, ttl) => `#APPLYLOCK ${op} ${nonce} ${ttl}\n`;
+const acquireScript = (holder, nonce, ttl) => `${header("acquire", nonce, ttl)}mkdir -p /opt/intentic 2>/dev/null
+[ -w /opt/intentic ] || { echo "CANNOT_WRITE /opt/intentic"; exit 1; }
+LOCK=${LOCK_DIR}
+META=$LOCK/meta.json
+write() {
+  printf '{"holder":"%s","nonce":"%s","expiresAt":%s}\\n' '${holder}' '${nonce}' "$(( $(date +%s) + ${ttl} ))" > "$META"
+  chmod 600 "$META" 2>/dev/null || true
+}
+if mkdir "$LOCK" 2>/dev/null; then write; echo ACQUIRED; exit 0; fi
+NOW=$(date +%s)
+EXP=$(sed -n 's/.*"expiresAt":\\([0-9]*\\).*/\\1/p' "$META" 2>/dev/null); [ -z "$EXP" ] && EXP=0
+CUR=$(sed -n 's/.*"holder":"\\([^"]*\\)".*/\\1/p' "$META" 2>/dev/null)
+if [ "$NOW" -ge "$EXP" ]; then write; echo TOOKOVER; exit 0; fi
+echo "HELD $CUR"; exit 1`;
+const verifyScript = (nonce, ttl) => `${header("verify", nonce, ttl)}CUR=$(sed -n 's/.*"nonce":"\\([^"]*\\)".*/\\1/p' ${LOCK_DIR}/meta.json 2>/dev/null)
+[ "$CUR" = '${nonce}' ] && echo OK || echo "LOST $CUR"`;
+const renewScript = (holder, nonce, ttl) => `${header("renew", nonce, ttl)}LOCK=${LOCK_DIR}
+META=$LOCK/meta.json
+CUR=$(sed -n 's/.*"nonce":"\\([^"]*\\)".*/\\1/p' "$META" 2>/dev/null)
+if [ "$CUR" = '${nonce}' ]; then printf '{"holder":"%s","nonce":"%s","expiresAt":%s}\\n' '${holder}' '${nonce}' "$(( $(date +%s) + ${ttl} ))" > "$META"; echo OK; else echo "LOST $CUR"; fi`;
+const releaseScript = (nonce, ttl) => `${header("release", nonce, ttl)}LOCK=${LOCK_DIR}
+META=$LOCK/meta.json
+CUR=$(sed -n 's/.*"nonce":"\\([^"]*\\)".*/\\1/p' "$META" 2>/dev/null)
+if [ "$CUR" = '${nonce}' ]; then rm -f "$META"; rmdir "$LOCK" 2>/dev/null; echo RELEASED; else echo "SKIP $CUR"; fi`;
+const run = async (executor, target, command) => {
+    const session = await executor.connect(target);
+    try {
+        return await session.exec(command);
+    }
+    finally {
+        await session.dispose();
+    }
+};
+export const acquireApplyLock = async (executor, targets, options = {}) => {
+    const ttl = options.ttlSeconds ?? DEFAULT_TTL_SECONDS;
+    const holder = options.holder ?? defaultHolder();
+    const nonce = randomBytes(16).toString("hex");
+    const log = options.log ?? (() => { });
+    const held = [];
+    const releaseAll = async () => {
+        for (const target of held) {
+            try {
+                await run(executor, target, releaseScript(nonce, ttl));
+            }
+            catch (error) {
+                log(`apply-lock: failed to release ${lockKey(target)} (it frees after its TTL): ${String(error)}`);
+            }
+        }
+    };
+    for (const target of orderedHosts(targets)) {
+        let result;
+        try {
+            result = await run(executor, target, acquireScript(holder, nonce, ttl));
+        }
+        catch (error) {
+            log(`apply-lock: ${lockKey(target)} is not reachable, skipping its lock: ${String(error)}`);
+            continue;
+        }
+        const outcome = result.stdout.trim();
+        if (outcome.startsWith("ACQUIRED") || outcome.startsWith("TOOKOVER")) {
+            held.push(target);
+            continue;
+        }
+        await releaseAll();
+        if (outcome.startsWith("CANNOT_WRITE")) {
+            throw new Error(`cannot create /opt/intentic on ${lockKey(target)} — the deploy user lacks write permission on it. Re-run this host's connect script (connect.sh for the sandbox's own machine, connect-host.sh for an enrolled host) — it provisions /opt/intentic for the service user; or create it as root: mkdir -p /opt/intentic && chown <deploy-user> /opt/intentic`);
+        }
+        const who = outcome.replace(/^HELD\s*/, "");
+        throw new Error(`another intentic run holds the apply lock on ${lockKey(target)}${who !== "" ? ` (held by ${who})` : ""} — wait for it to finish, or if it crashed the lock frees after its TTL`);
+    }
+    return {
+        verify: async () => {
+            for (const target of held) {
+                const result = await run(executor, target, verifyScript(nonce, ttl));
+                if (!result.stdout.trim().startsWith("OK")) {
+                    throw new Error(`apply lock on ${lockKey(target)} was taken over by another run — aborting before mutating to avoid concurrent writers`);
+                }
+            }
+        },
+        renew: async () => {
+            for (const target of held) {
+                await run(executor, target, renewScript(holder, nonce, ttl));
+            }
+        },
+        release: releaseAll,
+    };
+};
+//# sourceMappingURL=apply-lock.js.map

package/dist/apply/apply-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply-lock.js","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAYnC,MAAM,QAAQ,GAAG,4BAA4B,CAAC;AAE9C,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAWpC,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAIlF,MAAM,YAAY,GAAG,CAAC,OAA6B,EAAe,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AAItG,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CAAC,cAAc,EAAE,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;AAIxG,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACzE,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC;;OAE7B,QAAQ;;;6DAG8C,MAAM,MAAM,KAAK,wBAAwB,GAAG;;;;;;;;yBAQhF,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACxD,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,oDAAoD,QAAQ;cACjF,KAAK,oCAAoC,CAAC;AAExD,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACvE,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;iBAGjC,KAAK,sEAAsE,MAAM,MAAM,KAAK,wBAAwB,GAAG,oDAAoD,CAAC;AAE7L,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACzD,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;iBAGnC,KAAK,8FAA8F,CAAC;AAErH,MAAM,GAAG,GAAG,KAAK,EAAE,QAAqB,EAAE,MAAiB,EAAE,OAAe,EAAsB,EAAE;IAChG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACL,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACjC,QAAqB,EACrB,OAA6B,EAC7B,UAAgH,EAAE,EAChG,EAAE;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QACzC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,iCAAiC,OAAO,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,kCAAkC,OAAO,CAAC,MAAM,CAAC,2SAA2S,CAC/V,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,KAAK,CACX,gDAAgD,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,yEAAyE,CACnL,CAAC;IACN,CAAC;IAED,OAAO;QACH,MAAM,EAAE,KAAK,IAAI,EAAE;YACf,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACX,iBAAiB,OAAO,CAAC,MAAM,CAAC,uFAAuF,CAC1H,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACd,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU;KACtB,CAAC;AACN,CAAC,CAAC"}