@intentic/cli 1.0.2

package/dist/pipelines/control-plane-sync.js

@@ -0,0 +1,62 @@
+import { secretRef } from "@intentic/graph";
+import { forgejoApi } from "@intentic/providers";
+import { ARTIFACT_FILE, CONFIG_FILE, INTENT_DIR, TARGET_DIR } from "../lib/artifact.js";
+import { collectSecrets } from "../secrets/secrets.js";
+import { APPLY_WORKFLOW_PATH, applyWorkflowYaml, setRepoSecrets, writeWorkflow } from "./adopt-pipelines.js";
+export const forgejoIdentity = (graph) => {
+    const forgejo = Object.values(graph.resources).find((node) => node.type === "forgejo");
+    if (forgejo === undefined) {
+        throw new Error("no forgejo resource in the artifact — run `intentic apply` first");
+    }
+    const domain = forgejo.inputs["domain"];
+    const user = forgejo.inputs["adminUser"];
+    if (typeof domain !== "string" || typeof user !== "string") {
+        throw new Error("forgejo resource is missing its domain/adminUser inputs");
+    }
+    const adminPasswordRef = secretRef(forgejo.inputs["adminPassword"]);
+    if (adminPasswordRef === undefined) {
+        throw new Error("forgejo resource is missing its adminPassword secret");
+    }
+    return { domain, user, adminPasswordRef };
+};
+export const syncControlPlaneSecrets = async (args) => {
+    if (args.previousGraph === undefined) {
+        args.log("sync-control-plane: no previous artifact to diff against — skipping secret sync");
+        return { pushed: [], newEnv: [] };
+    }
+    const api = args.api ?? forgejoApi;
+    const { domain, user, adminPasswordRef } = forgejoIdentity(args.newGraph);
+    const previous = collectSecrets(args.previousGraph);
+    const next = collectSecrets(args.newGraph);
+    const addedGenerated = next.generated.filter((key) => !previous.generated.includes(key));
+    const newEnv = next.env.filter((key) => !previous.env.includes(key));
+    if (addedGenerated.length > 0) {
+        const secrets = {};
+        for (const key of addedGenerated) {
+            const value = args.env[key];
+            if (value === undefined || value === "") {
+                throw new Error(`generated secret ${key} has no value to push to Forgejo`);
+            }
+            secrets[key] = value;
+        }
+        await setRepoSecrets({ api, baseUrl: `https://${domain}`, user, password: args.password, owner: user, name: TARGET_DIR, secrets });
+        args.log(`sync-control-plane: pushed ${addedGenerated.length} new generated secret(s) to ${user}/${TARGET_DIR}: ${addedGenerated.join(", ")}`);
+    }
+    const inputs = {
+        cliVersion: args.cliVersion,
+        user,
+        domain,
+        configFile: CONFIG_FILE,
+        artifactFile: ARTIFACT_FILE,
+        intentRepo: INTENT_DIR,
+        desiredStateRepo: TARGET_DIR,
+        applySecretKeys: [...next.generated, ...next.env].toSorted(),
+        forgejoPasswordKey: adminPasswordRef.key,
+    };
+    await writeWorkflow(args.dir, APPLY_WORKFLOW_PATH, applyWorkflowYaml(inputs));
+    if (newEnv.length > 0) {
+        args.log(`sync-control-plane: set these user secret(s) in the app's Secrets page (or \`intentic secrets push\` after setting .env) — apply fails until they reach ${user}/${TARGET_DIR}: ${newEnv.join(", ")}`);
+    }
+    return { pushed: addedGenerated, newEnv };
+};
+//# sourceMappingURL=control-plane-sync.js.map

package/dist/pipelines/control-plane-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-sync.js","sourceRoot":"","sources":["../../src/pipelines/control-plane-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,SAAS,EAAqB,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAmB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAuB,cAAc,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAIlI,MAAM,CAAC,MAAM,eAAe,GAAG,CAC3B,KAAwB,EAC8G,EAAE;IACxI,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,gBAAgB,GAAG,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACpE,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC;AAC9C,CAAC,CAAC;AASF,MAAM,CAAC,MAAM,uBAAuB,GAAG,KAAK,EAAE,IAY7C,EAAuF,EAAE;IAGtF,IAAI,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,iFAAiF,CAAC,CAAC;QAC5F,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,cAAc,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACpD,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IACzF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAErE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,OAAO,GAA2B,EAAE,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YAE/B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,oBAAoB,GAAG,kCAAkC,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;QACD,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,GAAG,CACJ,8BAA8B,cAAc,CAAC,MAAM,+BAA+B,IAAI,IAAI,UAAU,KAAK,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACvI,CAAC;IACN,CAAC;IAGD,MAAM,MAAM,GAAmB;QAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,IAAI;QACJ,MAAM;QACN,UAAU,EAAE,WAAW;QACvB,YAAY,EAAE,aAAa;QAC3B,UAAU,EAAE,UAAU;QACtB,gBAAgB,EAAE,UAAU;QAC5B,eAAe,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;QAC5D,kBAAkB,EAAE,gBAAgB,CAAC,GAAG;KAC3C,CAAC;IACF,MAAM,aAAa,CAAC,IAAI,CAAC,GAAG,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9E,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,IAAI,CAAC,GAAG,CACJ,2JAA2J,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxM,CAAC;IACN,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC9C,CAAC,CAAC"}

package/dist/plan/plan.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const planCommand: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=plan.command.d.ts.map

package/dist/plan/plan.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.command.d.ts","sourceRoot":"","sources":["../../src/plan/plan.command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAUlE,eAAO,MAAM,WAAW,iDAqBtB,CAAC"}

package/dist/plan/plan.command.js

@@ -0,0 +1,33 @@
+import { dirname } from "node:path";
+import { plan } from "@intentic/engine";
+import { createProviders, createSshExecutor } from "@intentic/providers";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_PATH, loadEnvFile, readArtifact } from "../lib/artifact.js";
+import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { createOutput } from "../lib/output.js";
+import { withRunLog } from "../lib/run-log.js";
+import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { generatedSecretStore } from "../secrets/secret-store.js";
+import { collectSecrets } from "../secrets/secrets.js";
+export const planCommand = buildCommand({
+    docs: { brief: "Show what applying the artifact would create/update (read-only)" },
+    parameters: {
+        flags: { artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` } },
+    },
+    async func(flags) {
+        const out = createOutput(withRunLog(this.process.stdout, "plan"), loadConfig().intenticOutput);
+        const artifact = flags.artifact ?? ARTIFACT_PATH;
+        const dir = dirname(artifact);
+        loadEnvFile(dir);
+        const graph = await readArtifact(artifact);
+        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, false, out.log), collectSecrets(graph).generated, process.env);
+        const outcome = await plan(graph, { providers: createProviders({ ssh }), log: out.log, onEvent: out.onEvent });
+        for (const step of outcome.steps) {
+            out.text(`${step.action}\t${step.type}\t${step.id}${step.reason !== undefined ? `\t(${step.reason})` : ""}`);
+        }
+        out.result({ steps: outcome.steps, orphans: outcome.orphans });
+    },
+});
+//# sourceMappingURL=plan.command.js.map

package/dist/plan/plan.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plan.command.js","sourceRoot":"","sources":["../../src/plan/plan.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAwB;IAC3D,IAAI,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE;IAClF,UAAU,EAAE;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE,EAAE;KACpI;IACD,KAAK,CAAC,IAAI,CAAuB,KAA4B;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAC/F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAG1D,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/G,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC;CACJ,CAAC,CAAC"}

package/dist/resolve/resolve.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const resolveCommand: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=resolve.command.d.ts.map

package/dist/resolve/resolve.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.command.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAmBlE,eAAO,MAAM,cAAc,iDAoEzB,CAAC"}

package/dist/resolve/resolve.command.js

@@ -0,0 +1,78 @@
+import { existsSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { resolveState } from "@intentic/state-resolver";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_PATH, CONFIG_PATH, ENV_FILE, readArtifact, writeArtifact } from "../lib/artifact.js";
+import { createOutput } from "../lib/output.js";
+import { withRunLog } from "../lib/run-log.js";
+import { version } from "../lib/version.js";
+import { GIT_TOKEN_ENV } from "../pipelines/adopt-pipelines.js";
+import { syncControlPlaneSecrets } from "../pipelines/control-plane-sync.js";
+import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { createLocalSecretStore } from "../secrets/secret-store.js";
+import { collectSecrets, writeEnvExample } from "../secrets/secrets.js";
+import { discoverZone, loadIntent } from "./resolve.js";
+export const resolveCommand = buildCommand({
+    docs: { brief: "Resolve a deploy.config.ts into the desired-state artifact" },
+    parameters: {
+        flags: {
+            config: { kind: "parsed", parse: String, optional: true, brief: `Path to the intent config (default: ${CONFIG_PATH})` },
+            out: { kind: "parsed", parse: String, optional: true, brief: `Path to write the artifact (default: ${ARTIFACT_PATH})` },
+            syncControlPlane: {
+                kind: "boolean",
+                brief: "Push newly-required generated secrets into Forgejo and regenerate apply.yaml (run by the resolve pipeline post-adopt; needs GIT_TOKEN)",
+            },
+        },
+    },
+    async func(flags) {
+        const out = createOutput(withRunLog(this.process.stdout, "resolve"), loadConfig().intenticOutput);
+        const intent = await loadIntent(flags.config ?? CONFIG_PATH);
+        const artifactOut = flags.out ?? ARTIFACT_PATH;
+        const dir = dirname(artifactOut);
+        const previousGraph = flags.syncControlPlane && existsSync(artifactOut) ? await readArtifact(artifactOut) : undefined;
+        const zone = await discoverZone(intent, dir);
+        const graph = resolveState(intent, zone);
+        await writeArtifact(artifactOut, graph);
+        const count = Object.keys(graph.resources).length;
+        out.text(`resolved desired state (${count} resources) → ${artifactOut}`);
+        if (zone !== undefined) {
+            out.text(intent.cloudflare?.input.zone !== undefined
+                ? `using Cloudflare zone "${zone}" from the intent`
+                : `discovered Cloudflare zone "${zone}" from the API token`);
+        }
+        const { env: envKeys, generated } = collectSecrets(graph);
+        if (envKeys.length > 0) {
+            await writeEnvExample(join(dir, `${ENV_FILE}.example`), envKeys);
+            out.text(`set these in ${ENV_FILE} before apply (see ${ENV_FILE}.example): ${envKeys.join(", ")}`);
+        }
+        if (generated.length > 0) {
+            await ensureGeneratedSecrets(createLocalSecretStore(dir), generated, process.env);
+            out.text(`generated these (stored in .secrets.json): ${generated.join(", ")}`);
+        }
+        let synced;
+        if (flags.syncControlPlane) {
+            const password = process.env[GIT_TOKEN_ENV];
+            if (password === undefined || password === "") {
+                throw new Error(`set ${GIT_TOKEN_ENV} (the Forgejo admin password) to use --sync-control-plane`);
+            }
+            synced = await syncControlPlaneSecrets({
+                previousGraph,
+                newGraph: graph,
+                env: process.env,
+                dir,
+                password,
+                cliVersion: version,
+                log: out.log,
+            });
+        }
+        out.result({
+            resources: count,
+            ...(zone !== undefined ? { zone } : {}),
+            envSecrets: envKeys,
+            generatedSecrets: generated,
+            ...(synced !== undefined ? { synced } : {}),
+        });
+    },
+});
+//# sourceMappingURL=resolve.command.js.map

package/dist/resolve/resolve.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.command.js","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQxD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAe;IACrD,IAAI,EAAE,EAAE,KAAK,EAAE,4DAA4D,EAAE;IAC7E,UAAU,EAAE;QACR,KAAK,EAAE;YACH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,WAAW,GAAG,EAAE;YACvH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,wCAAwC,aAAa,GAAG,EAAE;YACvH,gBAAgB,EAAE;gBACd,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,wIAAwI;aAClJ;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAClG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,2BAA2B,KAAK,iBAAiB,WAAW,EAAE,CAAC,CAAC;QACzE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CACJ,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACvC,CAAC,CAAC,0BAA0B,IAAI,mBAAmB;gBACnD,CAAC,CAAC,+BAA+B,IAAI,sBAAsB,CAClE,CAAC;QACN,CAAC;QAKD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,sBAAsB,QAAQ,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAA8F,CAAC;QACnG,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,aAAa,2DAA2D,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBACnC,aAAa;gBACb,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG;gBACH,QAAQ;gBACR,UAAU,EAAE,OAAO;gBACnB,GAAG,EAAE,GAAG,CAAC,GAAG;aACf,CAAC,CAAC;QACP,CAAC;QACD,GAAG,CAAC,MAAM,CAAC;YACP,SAAS,EAAE,KAAK;YAChB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,OAAO;YACnB,gBAAgB,EAAE,SAAS;YAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}

package/dist/resolve/resolve.d.ts

@@ -0,0 +1,4 @@
+import type { IntentSet } from "@intentic/need-resolver";
+export declare const loadIntent: (configPath: string) => Promise<IntentSet>;
+export declare const discoverZone: (intent: IntentSet, dir: string) => Promise<string | undefined>;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/resolve/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAQzD,eAAO,MAAM,UAAU,GAAU,YAAY,MAAM,KAAG,OAAO,CAAC,SAAS,CAMtE,CAAC;AAQF,eAAO,MAAM,YAAY,GAAU,QAAQ,SAAS,EAAE,KAAK,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAsB7F,CAAC"}

package/dist/resolve/resolve.js

@@ -0,0 +1,33 @@
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { cloudflareApi } from "@intentic/providers";
+import { collectDomains, selectZone } from "@intentic/state-resolver";
+import { loadEnvFile } from "../lib/artifact.js";
+export const loadIntent = async (configPath) => {
+    const loaded = (await import(pathToFileURL(resolve(configPath)).href));
+    if (loaded.intent === undefined) {
+        throw new Error(`${configPath} must export "intent" (from defineIntent)`);
+    }
+    return loaded.intent;
+};
+export const discoverZone = async (intent, dir) => {
+    const cloudflare = intent.cloudflare;
+    if (cloudflare === undefined || (intent.apps.length === 0 && intent.services.length === 0)) {
+        return undefined;
+    }
+    if (cloudflare.input.zone !== undefined) {
+        return selectZone([cloudflare.input.zone], collectDomains(intent));
+    }
+    loadEnvFile(dir);
+    const token = cloudflare.input.apiToken;
+    if (token.source !== "env") {
+        throw new Error(`cloudflare apiToken must be an env() secret, but it is "${token.source}"`);
+    }
+    const apiToken = process.env[token.key];
+    if (apiToken === undefined || apiToken === "") {
+        throw new Error(`set ${token.key} (your Cloudflare API token) before resolve — it is needed to discover your zone and account`);
+    }
+    const zones = await cloudflareApi.listZones({ apiToken });
+    return selectZone(zones.map((zone) => zone.name), collectDomains(intent));
+};
+//# sourceMappingURL=resolve.js.map

package/dist/resolve/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKjD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAkB,EAAsB,EAAE;IACvE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAA2B,CAAC;IACjG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACzB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAiB,EAAE,GAAW,EAA+B,EAAE;IAC9F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,8FAA8F,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,UAAU,CACb,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,cAAc,CAAC,MAAM,CAAC,CACzB,CAAC;AACN,CAAC,CAAC"}

package/dist/restore/restore.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const restore: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=restore.command.d.ts.map

package/dist/restore/restore.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.command.d.ts","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAgBlE,eAAO,MAAM,OAAO,iDA0DlB,CAAC"}

package/dist/restore/restore.command.js

@@ -0,0 +1,68 @@
+import { dirname } from "node:path";
+import { createStore, resolveInputs } from "@intentic/engine";
+import { createSshExecutor, hostTarget, restoreBackup } from "@intentic/providers";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_PATH, loadEnvFile, readArtifact } from "../lib/artifact.js";
+import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { createOutput } from "../lib/output.js";
+import { withRunLog } from "../lib/run-log.js";
+import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { generatedSecretStore } from "../secrets/secret-store.js";
+import { collectSecrets } from "../secrets/secrets.js";
+export const restore = buildCommand({
+    docs: { brief: "Restore Forgejo/Komodo from a restic backup snapshot, then re-apply (one-shot recovery)" },
+    parameters: {
+        flags: {
+            artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` },
+            snapshot: { kind: "parsed", parse: String, optional: true, brief: "restic snapshot id to restore (default: latest)" },
+            only: { kind: "parsed", parse: String, optional: true, brief: "Which to restore: forgejo | komodo | all (default: all)" },
+        },
+    },
+    async func(flags) {
+        const out = createOutput(withRunLog(this.process.stdout, "restore"), loadConfig().intenticOutput);
+        const artifact = flags.artifact ?? ARTIFACT_PATH;
+        const dir = dirname(artifact);
+        loadEnvFile(dir);
+        const graph = await readArtifact(artifact);
+        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, false, out.log), collectSecrets(graph).generated, process.env);
+        const backupNode = Object.values(graph.resources).find((node) => node.type === "backup");
+        if (backupNode === undefined) {
+            throw new Error("no backup resource in the artifact — declare one with i.have.backup and apply it first");
+        }
+        const scope = flags.only ?? "all";
+        if (scope !== "forgejo" && scope !== "komodo" && scope !== "all") {
+            throw new Error(`--only must be one of forgejo|komodo|all, got "${scope}"`);
+        }
+        const resolved = resolveInputs(backupNode.inputs, createStore(), process.env, { lenient: false });
+        const repo = resolved["repo"];
+        const password = resolved["password"];
+        const image = resolved["image"];
+        if (typeof repo !== "string" || typeof password !== "string" || typeof image !== "string") {
+            throw new Error("backup resource is missing its repo/password/image inputs");
+        }
+        const credsRaw = resolved["credentials"];
+        const credentials = {};
+        if (typeof credsRaw === "object" && credsRaw !== null) {
+            for (const [key, value] of Object.entries(credsRaw)) {
+                if (typeof value === "string") {
+                    credentials[key] = value;
+                }
+            }
+        }
+        await restoreBackup({
+            target: hostTarget(resolved),
+            image,
+            repo,
+            password,
+            credentials,
+            snapshot: flags.snapshot ?? "latest",
+            scope: scope,
+            log: out.log,
+            executor: ssh,
+        });
+        out.result({ snapshot: flags.snapshot ?? "latest", scope });
+    },
+});
+//# sourceMappingURL=restore.command.js.map

package/dist/restore/restore.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.command.js","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAqB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAe;IAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,yFAAyF,EAAE;IAC1G,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iDAAiD,EAAE;YACrH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,yDAAyD,EAAE;SAC5H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAG3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClI,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,GAAG,CAAC,CAAC;QAChF,CAAC;QAGD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC5B,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC7B,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,aAAa,CAAC;YAChB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC5B,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;YACpC,KAAK,EAAE,KAAqB;YAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;CACJ,CAAC,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const sandboxTunnel: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=sandbox-tunnel.command.d.ts.map

package/dist/sandbox-tunnel/sandbox-tunnel.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.command.d.ts","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAQlE,eAAO,MAAM,aAAa,iDA4DxB,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.command.js

@@ -0,0 +1,62 @@
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { createSandboxTunnel } from "./sandbox-tunnel.js";
+export const sandboxTunnel = buildCommand({
+    docs: { brief: "Create/refresh the per-sandbox Cloudflare tunnel + DNS and print its connector token (used by connect.sh)" },
+    parameters: {
+        flags: {
+            service: {
+                kind: "parsed",
+                parse: String,
+                brief: "Internal service URL the tunnel routes to (e.g. http://intentic-sandbox-workspace:8787)",
+            },
+            previewService: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Preview-proxy URL to route the *.<zone> wildcard to (e.g. http://intentic-sandbox-workspace:5173)",
+            },
+            sshService: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "SSH URL to route ssh-<id>.<zone> to for local sync (e.g. ssh://intentic-sandbox-workspace:22)",
+            },
+            zone: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Cloudflare zone for the DNS record (default: the API token's sole zone, or set ZONE)",
+            },
+            subdomain: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Explicit subdomain prefix for the hostname (default: the derived sandbox-<id>)",
+            },
+        },
+    },
+    async func(flags) {
+        const config = loadConfig();
+        const { cloudflareApiToken: apiToken, connectToken } = config;
+        if (apiToken === "") {
+            throw new Error("set CLOUDFLARE_API_TOKEN");
+        }
+        if (connectToken === "") {
+            throw new Error("set CONNECT_TOKEN (the per-sandbox connection token)");
+        }
+        const zone = flags.zone ?? (config.zone !== "" ? config.zone : undefined);
+        const { token, hostname, sshHostname } = await createSandboxTunnel({
+            apiToken,
+            connectToken,
+            service: flags.service,
+            ...(flags.previewService !== undefined && flags.previewService !== "" ? { previewService: flags.previewService } : {}),
+            ...(flags.sshService !== undefined && flags.sshService !== "" ? { sshService: flags.sshService } : {}),
+            ...(zone !== undefined && zone !== "" ? { zone } : {}),
+            ...(flags.subdomain !== undefined && flags.subdomain !== "" ? { subdomain: flags.subdomain } : {}),
+            log: (message) => this.process.stderr.write(`${message}\n`),
+        });
+        this.process.stdout.write(`TUNNEL_TOKEN=${token}\nSANDBOX_HOSTNAME=${hostname}\n${sshHostname !== undefined ? `SANDBOX_SSH_HOSTNAME=${sshHostname}\n` : ""}`);
+    },
+});
+//# sourceMappingURL=sandbox-tunnel.command.js.map

package/dist/sandbox-tunnel/sandbox-tunnel.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.command.js","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAAuG;IAC5I,IAAI,EAAE,EAAE,KAAK,EAAE,2GAA2G,EAAE;IAC5H,UAAU,EAAE;QACR,KAAK,EAAE;YACH,OAAO,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,yFAAyF;aACnG;YACD,cAAc,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,mGAAmG;aAC7G;YACD,UAAU,EAAE;gBACR,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,+FAA+F;aACzG;YACD,IAAI,EAAE;gBACF,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,sFAAsF;aAChG;YACD,SAAS,EAAE;gBACP,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,gFAAgF;aAC1F;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAA2G;QACxI,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;QAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC;YAC/D,QAAQ;YACR,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtG,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CACrB,gBAAgB,KAAK,sBAAsB,QAAQ,KAAK,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,WAAW,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACrI,CAAC;IACN,CAAC;CACJ,CAAC,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.d.ts

@@ -0,0 +1,18 @@
+import { type CloudflareApi } from "@intentic/providers";
+export interface SandboxTunnelResult {
+    readonly token: string;
+    readonly hostname: string;
+    readonly sshHostname: string | undefined;
+}
+export declare const createSandboxTunnel: (args: {
+    readonly apiToken: string;
+    readonly connectToken: string;
+    readonly service: string;
+    readonly previewService?: string;
+    readonly sshService?: string;
+    readonly zone?: string;
+    readonly subdomain?: string;
+    readonly log: (message: string) => void;
+    readonly api?: CloudflareApi;
+}) => Promise<SandboxTunnelResult>;
+//# sourceMappingURL=sandbox-tunnel.d.ts.map

package/dist/sandbox-tunnel/sandbox-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.d.ts","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,qBAAqB,CAAC;AAIxE,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAG1B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC5C;AAMD,eAAO,MAAM,mBAAmB,GAAU,MAAM;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAGjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;CAChC,KAAG,OAAO,CAAC,mBAAmB,CAkC9B,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.js

@@ -0,0 +1,37 @@
+import { cloudflareApi } from "@intentic/providers";
+import { sandboxIdFromToken } from "@intentic/sandbox-contract/tunnel-ids";
+import { CATCH_ALL, resolveZone, upsertCname } from "../lib/cf-tunnel.js";
+export const createSandboxTunnel = async (args) => {
+    const { apiToken, connectToken, service, previewService, sshService, log } = args;
+    const api = args.api ?? cloudflareApi;
+    const zone = await resolveZone(api, apiToken, args.zone);
+    const id = sandboxIdFromToken(connectToken) ?? "";
+    const name = args.subdomain !== undefined && args.subdomain !== "" ? args.subdomain : `sandbox-${id}`;
+    const hostname = `${name}.${zone.name}`;
+    const previewHostname = `*.${zone.name}`;
+    const sshHostname = `ssh-${id}.${zone.name}`;
+    const withPreview = previewService !== undefined && previewService !== "";
+    const withSsh = sshService !== undefined && sshService !== "";
+    log(`resolving tunnel "${name}" on zone "${zone.name}"…`);
+    const existing = await api.findTunnel({ accountId: zone.accountId, apiToken, name });
+    const tunnel = existing ?? (await api.createTunnel({ accountId: zone.accountId, apiToken, name }));
+    const token = await api.getTunnelToken({ accountId: zone.accountId, apiToken, tunnelId: tunnel.id });
+    const ingress = [
+        { hostname, service },
+        ...(withSsh ? [{ hostname: sshHostname, service: sshService }] : []),
+        ...(withPreview ? [{ hostname: previewHostname, service: previewService }] : []),
+        CATCH_ALL,
+    ];
+    await api.putTunnelIngress({ accountId: zone.accountId, apiToken, tunnelId: tunnel.id, ingress });
+    const cname = `${tunnel.id}.cfargotunnel.com`;
+    await upsertCname(api, apiToken, zone.id, hostname, cname, "intentic sandbox tunnel");
+    if (withPreview) {
+        await upsertCname(api, apiToken, zone.id, previewHostname, cname, "intentic sandbox tunnel");
+    }
+    if (withSsh) {
+        await upsertCname(api, apiToken, zone.id, sshHostname, cname, "intentic sandbox ssh tunnel");
+    }
+    log(`tunnel "${name}" → ${hostname} ready`);
+    return { token, hostname, sshHostname: withSsh ? sshHostname : undefined };
+};
+//# sourceMappingURL=sandbox-tunnel.js.map

package/dist/sandbox-tunnel/sandbox-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.js","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uCAAuC,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAc1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,IAczC,EAAgC,EAAE;IAC/B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,kBAAkB,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;IACtG,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,KAAK,IAAI,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE,CAAC;IAC9D,GAAG,CAAC,qBAAqB,IAAI,cAAc,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IAGrG,MAAM,OAAO,GAAG;QACZ,EAAE,QAAQ,EAAE,OAAO,EAAE;QACrB,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,SAAS;KACZ,CAAC;IACF,MAAM,GAAG,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC9C,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACtF,IAAI,WAAW,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACV,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,6BAA6B,CAAC,CAAC;IACjG,CAAC;IACD,GAAG,CAAC,WAAW,IAAI,OAAO,QAAQ,QAAQ,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC/E,CAAC,CAAC"}

package/dist/secrets/generated-secrets.d.ts

@@ -0,0 +1,6 @@
+import type { SecretStore } from "./secret-store.js";
+type MutableEnv = Record<string, string | undefined>;
+export declare const ensureGeneratedSecrets: (store: SecretStore, keys: readonly string[], env: MutableEnv) => Promise<void>;
+export declare const readGeneratedSecrets: (dir: string) => Promise<Record<string, string>>;
+export {};
+//# sourceMappingURL=generated-secrets.d.ts.map

package/dist/secrets/generated-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAcrD,eAAO,MAAM,sBAAsB,GAAU,OAAO,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EAAE,KAAK,UAAU,KAAG,OAAO,CAAC,IAAI,CAcvH,CAAC;AAKF,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtF,CAAC"}

package/dist/secrets/generated-secrets.js

@@ -0,0 +1,26 @@
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { SECRETS_FILE } from "../lib/artifact.js";
+const generate = () => randomBytes(16).toString("hex");
+export const ensureGeneratedSecrets = async (store, keys, env) => {
+    for (const key of keys) {
+        if (env[key] !== undefined && env[key] !== "") {
+            continue;
+        }
+        const existing = await store.get(key);
+        if (existing !== undefined) {
+            env[key] = existing;
+            continue;
+        }
+        const value = generate();
+        await store.set(key, value);
+        env[key] = value;
+    }
+};
+export const readGeneratedSecrets = async (dir) => {
+    const path = join(dir, SECRETS_FILE);
+    return existsSync(path) ? JSON.parse(await readFile(path, "utf8")) : {};
+};
+//# sourceMappingURL=generated-secrets.js.map

package/dist/secrets/generated-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.js","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAU/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAkB,EAAE,IAAuB,EAAE,GAAe,EAAiB,EAAE;IACxH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC,CAAC"}

package/dist/secrets/secret-store.d.ts

@@ -0,0 +1,14 @@
+import type { DesiredStateGraph } from "@intentic/graph";
+import { type SshExecutor, type SshTarget } from "@intentic/providers";
+export interface SecretStore {
+    readonly get: (key: string) => Promise<string | undefined>;
+    readonly set: (key: string, value: string) => Promise<void>;
+}
+export declare const createLocalSecretStore: (dir: string) => SecretStore;
+export declare const createHostSecretStore: (target: SshTarget, executor: SshExecutor) => SecretStore;
+export declare const createLayeredSecretStore: (layers: readonly SecretStore[], options: {
+    readonly backfill: boolean;
+    readonly log?: (message: string) => void;
+}) => SecretStore;
+export declare const generatedSecretStore: (graph: DesiredStateGraph, dir: string, ssh: SshExecutor, backfill: boolean, log: (message: string) => void) => SecretStore;
+//# sourceMappingURL=secret-store.d.ts.map

package/dist/secrets/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAc,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAOnF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAID,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,WAYpD,CAAC;AAOF,eAAO,MAAM,qBAAqB,GAAI,QAAQ,SAAS,EAAE,UAAU,WAAW,KAAG,WAiChF,CAAC;AAOF,eAAO,MAAM,wBAAwB,GACjC,QAAQ,SAAS,WAAW,EAAE,EAC9B,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,KAClF,WA2CF,CAAC;AAUF,eAAO,MAAM,oBAAoB,GAC7B,OAAO,iBAAiB,EACxB,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,UAAU,OAAO,EACjB,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC/B,WAYF,CAAC"}