@intentic/cli 1.0.2

package/dist/apply/apply.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const apply: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=apply.command.d.ts.map

package/dist/apply/apply.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.command.d.ts","sourceRoot":"","sources":["../../src/apply/apply.command.ts"],"names":[],"mappings":"AAMA,OAAO,EAAgB,KAAK,cAAc,EAAgB,MAAM,eAAe,CAAC;AAqBhF,eAAO,MAAM,KAAK,iDAsKhB,CAAC"}

package/dist/apply/apply.command.js

@@ -0,0 +1,144 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { applyMoves, createStore, prune, reconcile, resolveInputs, rewriteGraphForMoves } from "@intentic/engine";
+import { createProviders, createSshExecutor, createSshProbe, hostTarget } from "@intentic/providers";
+import { buildCommand, numberParser } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ACCESS_FILE, ARTIFACT_PATH, LAST_APPLIED_FILE, loadEnvFile, readArtifact, STATUS_FILE, writeStatus } from "../lib/artifact.js";
+import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { createOutput } from "../lib/output.js";
+import { withRunLog } from "../lib/run-log.js";
+import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { generatedSecretStore } from "../secrets/secret-store.js";
+import { collectSecrets } from "../secrets/secrets.js";
+import { collectAccess, formatAccessSummary, writeAccessFile } from "./access.js";
+import { acquireApplyLock } from "./apply-lock.js";
+import { detectHostMoves, migrateHosts } from "./migrate.js";
+const DEFAULT_MAX_ITERATIONS = 5;
+export const apply = buildCommand({
+    docs: { brief: "Execute the desired-state artifact until state reads true" },
+    parameters: {
+        flags: {
+            artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` },
+            maxIterations: {
+                kind: "parsed",
+                parse: numberParser,
+                optional: true,
+                brief: `Max reconcile iterations (default ${DEFAULT_MAX_ITERATIONS})`,
+            },
+            previous: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Path to the last successfully-applied artifact; resources absent from the new one are pruned after convergence",
+            },
+        },
+    },
+    async func(flags) {
+        const out = createOutput(withRunLog(this.process.stdout, "apply"), loadConfig().intenticOutput);
+        const artifact = flags.artifact ?? ARTIFACT_PATH;
+        const dir = dirname(artifact);
+        loadEnvFile(dir);
+        const graph = await readArtifact(artifact);
+        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        const previousPath = flags.previous ?? join(dir, LAST_APPLIED_FILE);
+        const previous = existsSync(previousPath) ? await readArtifact(previousPath) : undefined;
+        const hostMoves = previous !== undefined ? detectHostMoves(previous, graph) : [];
+        const targets = Object.values(graph.resources)
+            .filter((node) => node.type === "host")
+            .map((node) => hostTarget(resolveInputs(node.inputs, createStore(), process.env, { lenient: false })));
+        const probes = targets.map((target) => createSshProbe(target, ssh));
+        const probe = probes.length === 0
+            ? undefined
+            : async (url, status) => {
+                for (const p of probes) {
+                    if (await p(url, status)) {
+                        return true;
+                    }
+                }
+                return false;
+            };
+        const oldMoveTargets = hostMoves.map((move) => hostTarget(resolveInputs(move.oldNode.inputs, createStore(), process.env, { lenient: false })));
+        const lock = await acquireApplyLock(ssh, [...targets, ...oldMoveTargets], { log: out.log });
+        const onSignal = () => {
+            void Promise.allSettled([lock.release(), ssh.dispose?.()]).finally(() => process.exit(130));
+        };
+        process.once("SIGINT", onSignal);
+        process.once("SIGTERM", onSignal);
+        try {
+            await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, true, out.log), collectSecrets(graph).generated, process.env);
+            if (hostMoves.length > 0) {
+                await migrateHosts(hostMoves, { next: graph, ssh, env: process.env, tmpDir: tmpdir(), log: out.log });
+            }
+            const movedApplied = await applyMoves(graph, {
+                providers: createProviders({ ssh }),
+                log: out.log,
+                onEvent: out.onEvent,
+                env: process.env,
+            });
+            const result = await reconcile(graph, { providers: createProviders({ ssh }), log: out.log, onEvent: out.onEvent, ...(probe !== undefined ? { probe } : {}) }, { maxIterations: flags.maxIterations ?? DEFAULT_MAX_ITERATIONS });
+            const access = collectAccess(graph, result.outcome.outputs, process.env);
+            await writeStatus(join(dir, STATUS_FILE), {
+                converged: result.converged,
+                iterations: result.iterations,
+                steps: result.outcome.steps,
+                access: access.map((entry) => entry.password === undefined ? entry : { ...entry, password: { source: entry.password.source, key: entry.password.key } }),
+            });
+            let pruned = { deleted: [], skipped: [] };
+            if (previous !== undefined) {
+                await lock.renew();
+                await lock.verify();
+                const baseline = rewriteGraphForMoves(previous, movedApplied);
+                pruned = await prune(baseline, graph, { providers: createProviders({ ssh }), log: out.log, onEvent: out.onEvent, env: process.env });
+                if (pruned.deleted.length > 0 || pruned.skipped.length > 0) {
+                    out.text(`pruned ${pruned.deleted.length} resource(s)${pruned.skipped.length > 0 ? `, ${pruned.skipped.length} left in place` : ""}`);
+                }
+            }
+            await writeFile(join(dir, LAST_APPLIED_FILE), await readFile(artifact, "utf8"));
+            out.text(`${result.converged ? "converged" : "did not converge"} in ${result.iterations} iteration(s)`);
+            if (access.length > 0) {
+                await writeAccessFile(join(dir, ACCESS_FILE), access);
+                out.text(formatAccessSummary(access));
+            }
+            out.result({
+                converged: result.converged,
+                iterations: result.iterations,
+                steps: result.outcome.steps,
+                outputs: result.outcome.outputs,
+                orphans: result.outcome.orphans,
+                pruned,
+                access,
+            });
+            const reconcileWebhook = result.outcome.outputs["discord"]?.["reconcileWebhook"];
+            if (typeof reconcileWebhook === "string" && reconcileWebhook !== "") {
+                const creates = result.outcome.steps.filter((s) => s.action === "create").length;
+                const updates = result.outcome.steps.filter((s) => s.action === "update").length;
+                const noops = result.outcome.steps.filter((s) => s.action === "noop").length;
+                const summary = [
+                    `**intentic apply** — ${result.converged ? "✅ converged" : "⚠️ did not converge"} in ${result.iterations} iteration(s)`,
+                    `📊 ${result.outcome.steps.length} resources: ${creates} created, ${updates} updated, ${noops} unchanged`,
+                    ...(result.outcome.orphans.length > 0 ? [`🗑️ ${result.outcome.orphans.length} orphan(s) detected`] : []),
+                ].join("\n");
+                try {
+                    await fetch(reconcileWebhook, {
+                        method: "POST",
+                        headers: { "Content-Type": "application/json" },
+                        body: JSON.stringify({ content: summary }),
+                    });
+                }
+                catch {
+                    out.log("discord: failed to post reconcile summary (non-fatal)");
+                }
+            }
+        }
+        finally {
+            process.removeListener("SIGINT", onSignal);
+            process.removeListener("SIGTERM", onSignal);
+            await lock.release();
+            await ssh.dispose?.();
+        }
+    },
+});
+//# sourceMappingURL=apply.command.js.map

package/dist/apply/apply.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apply.command.js","sourceRoot":"","sources":["../../src/apply/apply.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,WAAW,EAAqB,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACrI,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,YAAY,EAAuB,YAAY,EAAE,MAAM,eAAe,CAAC;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACxI,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE7D,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAQjC,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAAa;IAC1C,IAAI,EAAE,EAAE,KAAK,EAAE,2DAA2D,EAAE;IAC5E,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,aAAa,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,YAAY;gBACnB,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,qCAAqC,sBAAsB,GAAG;aACxE;YACD,QAAQ,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,gHAAgH;aAC1H;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAiB;QAC9C,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAI1D,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACpE,MAAM,QAAQ,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzF,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAKjF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;aACzC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC;aACtC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GACP,MAAM,CAAC,MAAM,KAAK,CAAC;YACf,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,KAAK,EAAE,GAAW,EAAE,MAAc,EAAoB,EAAE;gBACpD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;oBACrB,IAAI,MAAM,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,CAAC;wBACvB,OAAO,IAAI,CAAC;oBAChB,CAAC;gBACL,CAAC;gBACD,OAAO,KAAK,CAAC;YACjB,CAAC,CAAC;QAMZ,MAAM,cAAc,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAC1C,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CACjG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,GAAG,OAAO,EAAE,GAAG,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5F,MAAM,QAAQ,GAAG,GAAS,EAAE;YAExB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAChG,CAAC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QACjC,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC;YAID,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAIjI,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1G,CAAC;YAGD,MAAM,YAAY,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE;gBACzC,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC;gBACnC,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;aACnB,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAC1B,KAAK,EACL,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EACtH,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,sBAAsB,EAAE,CACnE,CAAC;YACF,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAGzE,MAAM,WAAW,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;gBACtC,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAC3B,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,QAAQ,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAC5H;aACJ,CAAC,CAAC;YAKH,IAAI,MAAM,GAAiB,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YACxD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAGzB,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBACnB,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBAGpB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBAC9D,MAAM,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;gBACrI,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBACzD,GAAG,CAAC,IAAI,CACJ,UAAU,MAAM,CAAC,OAAO,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,gBAAgB,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9H,CAAC;gBACN,CAAC;YACL,CAAC;YAED,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;YAChF,GAAG,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,OAAO,MAAM,CAAC,UAAU,eAAe,CAAC,CAAC;YACxG,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpB,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;gBACtD,GAAG,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;YAC1C,CAAC;YACD,GAAG,CAAC,MAAM,CAAC;gBACP,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK;gBAC3B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;gBAC/B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO;gBAC/B,MAAM;gBACN,MAAM;aACT,CAAC,CAAC;YAEH,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,kBAAkB,CAAC,CAAC;YACjF,IAAI,OAAO,gBAAgB,KAAK,QAAQ,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;gBAClE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;gBACjF,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;gBAC7E,MAAM,OAAO,GAAG;oBACZ,wBAAwB,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,qBAAqB,OAAO,MAAM,CAAC,UAAU,eAAe;oBACvH,MAAM,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,eAAe,OAAO,aAAa,OAAO,aAAa,KAAK,YAAY;oBACzG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,qBAAqB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACb,IAAI,CAAC;oBACD,MAAM,KAAK,CAAC,gBAAgB,EAAE;wBAC1B,MAAM,EAAE,MAAM;wBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;wBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;qBAC7C,CAAC,CAAC;gBACP,CAAC;gBAAC,MAAM,CAAC;oBACL,GAAG,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;gBACrE,CAAC;YACL,CAAC;QACL,CAAC;gBAAS,CAAC;YACP,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAC3C,OAAO,CAAC,cAAc,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC5C,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAErB,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/apply/migrate.d.ts

@@ -0,0 +1,20 @@
+import type { DesiredStateGraph, ResourceNode } from "@intentic/graph";
+import { type SshExecutor } from "@intentic/providers";
+export interface HostMove {
+    readonly id: string;
+    readonly oldNode: ResourceNode;
+    readonly newNode: ResourceNode;
+    readonly oldAddress: string;
+    readonly newAddress: string;
+}
+export declare const detectHostMoves: (previous: DesiredStateGraph, next: DesiredStateGraph) => HostMove[];
+interface MigrateArgs {
+    readonly next: DesiredStateGraph;
+    readonly ssh: SshExecutor;
+    readonly env: Record<string, string | undefined>;
+    readonly tmpDir: string;
+    readonly log: (message: string) => void;
+}
+export declare const migrateHosts: (moves: readonly HostMove[], args: MigrateArgs) => Promise<void>;
+export {};
+//# sourceMappingURL=migrate.d.ts.map

package/dist/apply/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../src/apply/migrate.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACvE,OAAO,EAOH,KAAK,WAAW,EAInB,MAAM,qBAAqB,CAAC;AAK7B,MAAM,WAAW,QAAQ;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAID,eAAO,MAAM,eAAe,GAAI,UAAU,iBAAiB,EAAE,MAAM,iBAAiB,KAAG,QAAQ,EAqB9F,CAAC;AAEF,UAAU,WAAW;IACjB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AAwGD,eAAO,MAAM,YAAY,GAAU,OAAO,SAAS,QAAQ,EAAE,EAAE,MAAM,WAAW,KAAG,OAAO,CAAC,IAAI,CAI9F,CAAC"}

package/dist/apply/migrate.js

@@ -0,0 +1,112 @@
+import { rm } from "node:fs/promises";
+import { join } from "node:path";
+import { createStore, resolveInputs } from "@intentic/engine";
+import { hostTarget, isLocalRepo, managedContainers, quiesceHost, restoreBackup, snapshotNow, streamRepoVolume, } from "@intentic/providers";
+export const detectHostMoves = (previous, next) => {
+    const moves = [];
+    for (const [id, newNode] of Object.entries(next.resources)) {
+        if (newNode.type !== "host") {
+            continue;
+        }
+        const oldNode = previous.resources[id];
+        if (oldNode === undefined || oldNode.type !== "host") {
+            continue;
+        }
+        const oldAddress = oldNode.inputs["address"];
+        const newAddress = newNode.inputs["address"];
+        if (typeof oldAddress !== "string" || typeof newAddress !== "string") {
+            throw new Error(`host "${id}" address is not a literal string; a host migration needs a literal address on both sides`);
+        }
+        if (oldAddress === newAddress) {
+            continue;
+        }
+        moves.push({ id, oldNode, newNode, oldAddress, newAddress });
+    }
+    return moves;
+};
+const backupFor = (move, args) => {
+    const node = Object.values(args.next.resources).find((n) => n.type === "backup" && n.inputs["address"] === move.newAddress);
+    if (node === undefined) {
+        return undefined;
+    }
+    const resolved = resolveInputs(node.inputs, createStore(), args.env, { lenient: false });
+    const { repo, password, image } = resolved;
+    if (typeof repo !== "string" || typeof password !== "string" || typeof image !== "string") {
+        throw new Error(`backup for host "${move.id}" is missing its repo/password/image inputs`);
+    }
+    const credentials = {};
+    const credsRaw = resolved["credentials"];
+    if (typeof credsRaw === "object" && credsRaw !== null) {
+        for (const [key, value] of Object.entries(credsRaw)) {
+            if (typeof value === "string") {
+                credentials[key] = value;
+            }
+        }
+    }
+    return { repo, password, image, credentials };
+};
+const migrateHost = async (move, args) => {
+    const backup = backupFor(move, args);
+    if (backup === undefined) {
+        args.log(`host "${move.id}" moved ${move.oldAddress} → ${move.newAddress} but runs no control plane; its data is not migrated (apps are recreated on the new host)`);
+        return;
+    }
+    const newTarget = hostTarget(resolveInputs(move.newNode.inputs, createStore(), args.env, { lenient: false }));
+    const oldTarget = hostTarget(resolveInputs(move.oldNode.inputs, createStore(), args.env, { lenient: false }));
+    const local = isLocalRepo(backup.repo);
+    let oldSession;
+    try {
+        oldSession = await args.ssh.connect(oldTarget);
+    }
+    catch (error) {
+        if (local) {
+            throw new Error(`host "${move.id}" moved to ${move.newAddress}, but its old machine ${move.oldAddress} is unreachable and the restic repo lives on it — bring the old host back to migrate its data: ${String(error)}`, { cause: error });
+        }
+        args.log(`old host ${move.oldAddress} unreachable; restoring "${move.id}" on ${move.newAddress} from the latest snapshot in ${backup.repo} (data is as of the last scheduled backup)`);
+    }
+    if (oldSession !== undefined) {
+        try {
+            const managed = await managedContainers(oldSession);
+            if (managed.length === 0) {
+                args.log(`old host ${move.oldAddress} has no intentic-managed containers; nothing to migrate for "${move.id}"`);
+                return;
+            }
+            args.log(`migrating host "${move.id}" ${move.oldAddress} → ${move.newAddress} (${managed.length} managed container(s))`);
+            await quiesceHost(oldSession);
+            await snapshotNow(oldSession, args.log);
+            await oldSession.exec("docker stop intentic-backup 2>/dev/null || true");
+            if (local) {
+                const tarPath = join(args.tmpDir, `intentic-migrate-${move.id}.tgz`);
+                const newSession = await args.ssh.connect(newTarget);
+                try {
+                    await streamRepoVolume(oldSession, newSession, backup.image, tarPath, args.log);
+                }
+                finally {
+                    await newSession.dispose();
+                    await rm(tarPath, { force: true });
+                }
+            }
+        }
+        finally {
+            await oldSession.dispose();
+        }
+    }
+    await restoreBackup({
+        target: newTarget,
+        image: backup.image,
+        repo: backup.repo,
+        password: backup.password,
+        credentials: backup.credentials,
+        snapshot: "latest",
+        scope: "all",
+        log: args.log,
+        executor: args.ssh,
+    });
+    args.log(`restored "${move.id}" data onto ${move.newAddress}; reconcile will bring its services up next`);
+};
+export const migrateHosts = async (moves, args) => {
+    for (const move of moves) {
+        await migrateHost(move, args);
+    }
+};
+//# sourceMappingURL=migrate.js.map

package/dist/apply/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../src/apply/migrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EACH,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EAEX,aAAa,EAGb,WAAW,EACX,gBAAgB,GACnB,MAAM,qBAAqB,CAAC;AAe7B,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAA2B,EAAE,IAAuB,EAAc,EAAE;IAChG,MAAM,KAAK,GAAe,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACnD,SAAS;QACb,CAAC;QACD,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CAAC,SAAS,EAAE,2FAA2F,CAAC,CAAC;QAC5H,CAAC;QACD,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;YAC5B,SAAS;QACb,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC,CAAC;AAaF,MAAM,SAAS,GAAG,CACd,IAAc,EACd,IAAiB,EACiF,EAAE;IACpG,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,CAAC;IAC5H,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACzF,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC;IAC3C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,oBAAoB,IAAI,CAAC,EAAE,6CAA6C,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,WAAW,GAA2B,EAAE,CAAC;IAC/C,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC5B,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YAC7B,CAAC;QACL,CAAC;IACL,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;AAClD,CAAC,CAAC;AAOF,MAAM,WAAW,GAAG,KAAK,EAAE,IAAc,EAAE,IAAiB,EAAiB,EAAE;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CACJ,SAAS,IAAI,CAAC,EAAE,WAAW,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,UAAU,2FAA2F,CAC7J,CAAC;QACF,OAAO;IACX,CAAC;IACD,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,SAAS,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC9G,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAEvC,IAAI,UAAkC,CAAC;IACvC,IAAI,CAAC;QACD,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,KAAK,EAAE,CAAC;YACR,MAAM,IAAI,KAAK,CACX,SAAS,IAAI,CAAC,EAAE,cAAc,IAAI,CAAC,UAAU,yBAAyB,IAAI,CAAC,UAAU,kGAAkG,MAAM,CAAC,KAAK,CAAC,EAAE,EACtM,EAAE,KAAK,EAAE,KAAK,EAAE,CACnB,CAAC;QACN,CAAC;QACD,IAAI,CAAC,GAAG,CACJ,YAAY,IAAI,CAAC,UAAU,4BAA4B,IAAI,CAAC,EAAE,QAAQ,IAAI,CAAC,UAAU,gCAAgC,MAAM,CAAC,IAAI,4CAA4C,CAC/K,CAAC;IACN,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,UAAU,gEAAgE,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;gBAChH,OAAO;YACX,CAAC;YACD,IAAI,CAAC,GAAG,CAAC,mBAAmB,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,UAAU,MAAM,IAAI,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,wBAAwB,CAAC,CAAC;YACzH,MAAM,WAAW,CAAC,UAAU,CAAC,CAAC;YAC9B,MAAM,WAAW,CAAC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,MAAM,UAAU,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACzE,IAAI,KAAK,EAAE,CAAC;gBACR,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,oBAAoB,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;gBACrE,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBACrD,IAAI,CAAC;oBACD,MAAM,gBAAgB,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;gBACpF,CAAC;wBAAS,CAAC;oBACP,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;oBAC3B,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACvC,CAAC;YACL,CAAC;QACL,CAAC;gBAAS,CAAC;YACP,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC;QAC/B,CAAC;IACL,CAAC;IAED,MAAM,aAAa,CAAC;QAChB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,KAA4B;QACnC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,QAAQ,EAAE,IAAI,CAAC,GAAG;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,EAAE,eAAe,IAAI,CAAC,UAAU,6CAA6C,CAAC,CAAC;AAC9G,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,KAA0B,EAAE,IAAiB,EAAiB,EAAE;IAC/F,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,CAAC;AACL,CAAC,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,5 @@
+#!/usr/bin/env node
+import { run } from "@stricli/core";
+import { app } from "./app.js";
+await run(app, process.argv.slice(2), { process: process });
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,eAAe,CAAC;AACpC,OAAO,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAI/B,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,OAAyB,EAAE,CAAC,CAAC"}

package/dist/demo.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=demo.d.ts.map

package/dist/demo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"demo.d.ts","sourceRoot":"","sources":["../src/demo.ts"],"names":[],"mappings":""}

package/dist/demo.js

@@ -0,0 +1,281 @@
+import { execFile, spawn } from "node:child_process";
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { promisify } from "node:util";
+import { cloudflareApi, forgejoApi, sshExecutor } from "@intentic/providers";
+import { deploymentId, deploymentPort } from "@intentic/state-resolver";
+import { loadConfig } from "./env.config.js";
+import { renderTemplate } from "./lib/templates.js";
+import { readGeneratedSecrets } from "./secrets/generated-secrets.js";
+const { utils } = createRequire(import.meta.url)("ssh2");
+const exec = promisify(execFile);
+const repoRoot = fileURLToPath(new URL("../../../", import.meta.url));
+const cliJs = join(repoRoot, "_apps/cli/dist/cli.js");
+const stateDir = join(repoRoot, ".demo");
+const stateFile = join(stateDir, "state.json");
+const CONTAINER = "intentic-demo-host";
+const TUNNEL = "intentic-host";
+const ADMIN = "intentic";
+const APP = "app";
+const ENV = "production";
+const APP_BODY = "intentic-demo-live";
+const appPort = deploymentPort(deploymentId(APP, ENV));
+const config = loadConfig();
+const zone = config.cloudflareZone;
+const sshPort = config.demo.sshPort;
+const forgejoPort = config.demo.forgejoPort;
+const komodoPort = config.demo.komodoPort;
+const GIT_URL = `https://git.${zone}`;
+const KOMODO_URL = `https://deploy.${zone}`;
+const APP_URL = `https://app.${zone}`;
+const log = (message) => {
+    process.stdout.write(`${message}\n`);
+};
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const dohHook = pathToFileURL(join(repoRoot, "_apps/cli/doh-lookup.mjs")).href;
+const cliEnv = {
+    ...process.env,
+    DEMO_DOH_ZONE: zone,
+    NODE_OPTIONS: `${config.nodeOptions} --import=${dohHook}`.trim(),
+};
+const run = (command, args, env = process.env) => new Promise((resolve, reject) => {
+    const child = spawn(command, args, { cwd: repoRoot, env, stdio: ["ignore", "inherit", "inherit"] });
+    child.on("error", reject);
+    child.on("exit", (code) => {
+        if (code === 0) {
+            resolve();
+        }
+        else {
+            reject(new Error(`${command} ${args.join(" ")} exited ${code}`));
+        }
+    });
+});
+const runCli = (...args) => run(process.execPath, [cliJs, ...args], cliEnv);
+const quiet = async (command, args) => {
+    try {
+        await exec(command, args, { maxBuffer: 16 * 1024 * 1024 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const readToken = async () => {
+    if (config.cloudflareApiToken !== "") {
+        return config.cloudflareApiToken.replace(/\\/g, "").trim();
+    }
+    const envText = await readFile(join(repoRoot, "desired-state/.env"), "utf8");
+    const match = /^CLOUDFLARE_API_TOKEN=(.*)$/m.exec(envText);
+    if (match?.[1] === undefined) {
+        throw new Error("CLOUDFLARE_API_TOKEN is not set and was not found in desired-state/.env");
+    }
+    return match[1].replace(/\\/g, "").trim();
+};
+const deployConfig = () => renderTemplate("demo/deploy.config.ts", { sshPort, app: APP, env: ENV, domain: `app.${zone}`, appPort: String(appPort) });
+const envFile = (privateKey, apiToken) => renderTemplate("demo/env", { privateKey, apiToken });
+const DOCKERFILE = renderTemplate("demo/Dockerfile", { appBody: APP_BODY });
+const ssh = async (command) => {
+    const session = await sshExecutor.connect({ address: "127.0.0.1", port: sshPort, user: "root", privateKey });
+    try {
+        const result = await session.exec(command);
+        return `${result.stdout}${result.stderr}`;
+    }
+    finally {
+        await session.dispose();
+    }
+};
+let privateKey = "";
+const up = async () => {
+    const apiToken = await readToken();
+    const keys = utils.generateKeyPairSync("ed25519");
+    privateKey = keys.private;
+    let forgejoPassword = "";
+    let komodoPassword = "";
+    log(`▶ building the demo host image (${CONTAINER}) from test/host …`);
+    await run("docker", ["build", "-t", CONTAINER, join(repoRoot, "test/host")]);
+    log("▶ starting the persistent Docker-in-Docker host …");
+    await quiet("docker", ["rm", "-f", CONTAINER]);
+    await run("docker", [
+        "run",
+        "-d",
+        "--privileged",
+        "--dns",
+        "1.1.1.1",
+        "--dns",
+        "1.0.0.1",
+        "--name",
+        CONTAINER,
+        "-e",
+        "DOCKER_TLS_CERTDIR=",
+        "-p",
+        `${sshPort}:22`,
+        "-p",
+        `${forgejoPort}:3000`,
+        "-p",
+        `${komodoPort}:9120`,
+        CONTAINER,
+    ]);
+    log("▶ injecting the demo SSH key …");
+    for (let i = 0; i < 60 && !(await quiet("docker", ["exec", CONTAINER, "true"])); i++) {
+        await sleep(1000);
+    }
+    await exec("docker", [
+        "exec",
+        CONTAINER,
+        "sh",
+        "-c",
+        `mkdir -p /root/.ssh && chmod 700 /root/.ssh && printf '%s\\n' '${keys.public}' > /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys`,
+    ]);
+    log(`▶ waiting for SSH on 127.0.0.1:${sshPort} …`);
+    for (let i = 0;; i++) {
+        try {
+            await (await sshExecutor.connect({ address: "127.0.0.1", port: sshPort, user: "root", privateKey })).dispose();
+            break;
+        }
+        catch (error) {
+            if (i >= 90) {
+                throw new Error(`host SSH never came up: ${String(error)}`, { cause: error });
+            }
+            await sleep(1000);
+        }
+    }
+    const workspace = repoRoot;
+    const configPath = join(workspace, "intent", "deploy.config.ts");
+    const artifactPath = join(workspace, "desired-state", "desired-state.json");
+    await mkdir(stateDir, { recursive: true });
+    await writeFile(stateFile, JSON.stringify({
+        zone,
+        apiToken,
+        container: CONTAINER,
+        sshPort,
+        urls: { git: GIT_URL, komodo: KOMODO_URL, app: APP_URL },
+        local: { git: `http://127.0.0.1:${forgejoPort}`, komodo: `http://127.0.0.1:${komodoPort}` },
+    }, null, 2));
+    log("▶ scaffolding the intent (init --link) …");
+    await runCli("init", "--dir", workspace, "--link");
+    await writeFile(configPath, deployConfig());
+    await writeFile(join(workspace, "desired-state", ".env"), envFile(privateKey, apiToken));
+    log("▶ resolve + apply — Forgejo + Komodo + tunnel + the app's CI/CD wiring …");
+    await runCli("resolve", "--config", configPath, "--out", artifactPath);
+    await runCli("apply", "--artifact", artifactPath, "--maxIterations", "8");
+    const secrets = await readGeneratedSecrets(join(workspace, "desired-state"));
+    forgejoPassword = secrets["FORGEJO_ADMIN_PASSWORD"] ?? "";
+    komodoPassword = secrets["KOMODO_ADMIN_PASSWORD"] ?? "";
+    const running = await ssh("docker ps --format '{{.Names}}'");
+    for (const name of ["intentic-forgejo", "intentic-forgejo-runner", "komodo-core"]) {
+        if (!running.includes(name)) {
+            throw new Error(`platform container "${name}" is not running on the host:\n${running}`);
+        }
+    }
+    log(`✅ platform up — host containers: ${running.split("\n").filter(Boolean).join(", ")}`);
+    log("▶ seeding the app repo (intentic/app @ main) with a Dockerfile …");
+    let appDeployed = false;
+    try {
+        await forgejoApi.commitFile({
+            baseUrl: `http://127.0.0.1:${forgejoPort}`,
+            user: ADMIN,
+            password: forgejoPassword,
+            owner: ADMIN,
+            name: APP,
+            branch: "main",
+            path: "Dockerfile",
+            content: DOCKERFILE,
+            message: "seed demo app",
+        });
+        log(`▶ CI builds + pushes the image and Komodo rolls it out — polling http://127.0.0.1:${appPort} …`);
+        const deadline = Date.now() + 5 * 60_000;
+        while (!appDeployed && Date.now() < deadline) {
+            const hit = (await ssh(`wget -q -T 5 -O- http://127.0.0.1:${appPort} 2>/dev/null || true`)).trim();
+            appDeployed = hit.includes(APP_BODY);
+            if (!appDeployed) {
+                await sleep(2000);
+            }
+        }
+        log(appDeployed
+            ? `✅ app deployed by CI/CD — serving "${APP_BODY}" on the host`
+            : `⚠ app not live yet on :${appPort} (CI/CD may still be running)`);
+    }
+    catch (error) {
+        log(`⚠ app phase skipped (platform stays up): ${String(error)}`);
+    }
+    log("");
+    log("════════════════════════════════════════════════════════════════════");
+    log("  intentic demo is UP and will stay up until you run `pnpm demo:down`");
+    log("════════════════════════════════════════════════════════════════════");
+    log("  Public (through the Cloudflare tunnel — DNS/edge may take ~1 min):");
+    log(`    Forgejo : ${GIT_URL}`);
+    log(`    Komodo  : ${KOMODO_URL}`);
+    if (appDeployed) {
+        log(`    App     : ${APP_URL}`);
+    }
+    log("  Local (instant, no DNS needed):");
+    log(`    Forgejo : http://127.0.0.1:${forgejoPort}`);
+    log(`    Komodo  : http://127.0.0.1:${komodoPort}`);
+    log("  Admin login (intentic-generated):");
+    log(`    user     : ${ADMIN}`);
+    log(`    Forgejo pw: ${forgejoPassword}`);
+    log(`    Komodo pw : ${komodoPassword}`);
+    log(`    (saved in ${join(workspace, "desired-state", ".secrets.json")})`);
+    log(`  SSH into the host:  ssh -p ${sshPort} root@127.0.0.1   (key in ${join(workspace, "desired-state", ".env")})`);
+    log("  Push the control-plane repos to Forgejo:  pnpm intentic adopt   (once git DNS is live)");
+    log("  Stop (reuses tunnel + DNS, fast re-up) :  pnpm demo:down");
+    log("  Full teardown (also removes tunnel+DNS):  pnpm demo:clear");
+    log("  Note: keep this machine + Docker running; the public URLs share the");
+    log("        tunnel name 'intentic-host', so don't run the e2e at the same time.");
+    log("════════════════════════════════════════════════════════════════════");
+};
+const down = async () => {
+    log(`▶ stopping the demo host container (${CONTAINER}) — leaving the Cloudflare tunnel + DNS for a fast re-up …`);
+    await quiet("docker", ["rm", "-f", CONTAINER]);
+    log("✅ demo stopped. `pnpm demo:up` reconnects in seconds (tunnel + DNS reused); `pnpm demo:clear` tears down Cloudflare too.");
+};
+const clear = async () => {
+    const state = await readFile(stateFile, "utf8")
+        .then((text) => JSON.parse(text))
+        .catch(() => ({}));
+    const zoneName = state.zone ?? zone;
+    const apiToken = state.apiToken ?? (await readToken());
+    log(`▶ removing the demo host container (${CONTAINER}) …`);
+    await quiet("docker", ["rm", "-f", CONTAINER]);
+    log("▶ deleting the Cloudflare tunnel + DNS records …");
+    const cfZone = await cloudflareApi.getZone({ apiToken, zone: zoneName }).catch(() => undefined);
+    if (cfZone !== undefined) {
+        const tunnel = await cloudflareApi.findTunnel({ accountId: cfZone.accountId, apiToken, name: TUNNEL }).catch(() => undefined);
+        if (tunnel !== undefined) {
+            await fetch(`https://api.cloudflare.com/client/v4/accounts/${cfZone.accountId}/cfd_tunnel/${tunnel.id}/connections`, {
+                method: "DELETE",
+                headers: { Authorization: `Bearer ${apiToken}` },
+            }).catch(() => { });
+            await cloudflareApi
+                .deleteTunnel({ accountId: cfZone.accountId, apiToken, tunnelId: tunnel.id })
+                .catch((error) => log(`  tunnel: ${String(error)}`));
+        }
+        for (const name of [`git.${zoneName}`, `deploy.${zoneName}`, `app.${zoneName}`]) {
+            const record = await cloudflareApi.findDnsRecord({ apiToken, zoneId: cfZone.id, name }).catch(() => undefined);
+            if (record !== undefined) {
+                await cloudflareApi
+                    .deleteDnsRecord({ apiToken, zoneId: cfZone.id, recordId: record.id })
+                    .catch((error) => log(`  dns ${name}: ${String(error)}`));
+            }
+        }
+    }
+    await rm(stateDir, { recursive: true, force: true }).catch(() => { });
+    log("✅ demo cleared — host container, tunnel, and DNS records removed (intent/ + desired-state/ kept).");
+};
+const mode = process.argv[2];
+if (mode === "up") {
+    await up();
+}
+else if (mode === "down") {
+    await down();
+}
+else if (mode === "clear" || mode === "clean") {
+    await clear();
+}
+else {
+    log("usage: demo <up|down|clear>");
+    process.exit(1);
+}
+//# sourceMappingURL=demo.js.map