@intentic/cli 1.0.2

package/dist/secrets/secret-store.js

@@ -0,0 +1,111 @@
+import { existsSync } from "node:fs";
+import { readFile, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import { createStore, resolveInputs } from "@intentic/engine";
+import { hostTarget } from "@intentic/providers";
+import { SECRETS_FILE } from "../lib/artifact.js";
+export const createLocalSecretStore = (dir) => {
+    const path = join(dir, SECRETS_FILE);
+    const read = async () => existsSync(path) ? JSON.parse(await readFile(path, "utf8")) : {};
+    return {
+        get: async (key) => (await read())[key],
+        set: async (key, value) => {
+            const store = await read();
+            store[key] = value;
+            await writeFile(path, `${JSON.stringify(store, undefined, 4)}\n`, { mode: 0o600 });
+        },
+    };
+};
+const HOST_SECRETS_PATH = "/opt/intentic/secrets.json";
+export const createHostSecretStore = (target, executor) => {
+    let cache;
+    const load = async () => {
+        if (cache !== undefined) {
+            return cache;
+        }
+        const session = await executor.connect(target);
+        try {
+            const result = await session.exec(`cat ${HOST_SECRETS_PATH} 2>/dev/null || echo '{}'`);
+            cache = JSON.parse(result.stdout.trim() || "{}");
+        }
+        finally {
+            await session.dispose();
+        }
+        return cache;
+    };
+    return {
+        get: async (key) => (await load())[key],
+        set: async (key, value) => {
+            const store = await load();
+            store[key] = value;
+            const json = JSON.stringify(store, undefined, 4);
+            const session = await executor.connect(target);
+            try {
+                await session.exec(`mkdir -p /opt/intentic && cat > ${HOST_SECRETS_PATH}.tmp <<'INTENTIC_SECRETS_EOF'\n${json}\nINTENTIC_SECRETS_EOF\nchmod 600 ${HOST_SECRETS_PATH}.tmp && mv ${HOST_SECRETS_PATH}.tmp ${HOST_SECRETS_PATH}`);
+            }
+            finally {
+                await session.dispose();
+            }
+        },
+    };
+};
+export const createLayeredSecretStore = (layers, options) => {
+    const log = options.log ?? (() => { });
+    return {
+        get: async (key) => {
+            const values = [];
+            for (const layer of layers) {
+                try {
+                    values.push(await layer.get(key));
+                }
+                catch (error) {
+                    log(`secret-store: a layer's read of "${key}" failed, skipping it: ${String(error)}`);
+                    values.push(undefined);
+                }
+            }
+            const result = values.find((value) => value !== undefined);
+            if (result !== undefined && options.backfill) {
+                for (const [i, layer] of layers.entries()) {
+                    if (values[i] === result) {
+                        continue;
+                    }
+                    try {
+                        await layer.set(key, result);
+                    }
+                    catch (error) {
+                        log(`secret-store: failed to backfill "${key}" into a layer: ${String(error)}`);
+                    }
+                }
+            }
+            return result;
+        },
+        set: async (key, value) => {
+            let persisted = false;
+            for (const layer of layers) {
+                try {
+                    await layer.set(key, value);
+                    persisted = true;
+                }
+                catch (error) {
+                    log(`secret-store: a layer's write of "${key}" failed: ${String(error)}`);
+                }
+            }
+            if (!persisted) {
+                throw new Error(`failed to persist generated secret "${key}" to any store`);
+            }
+        },
+    };
+};
+export const generatedSecretStore = (graph, dir, ssh, backfill, log) => {
+    const local = createLocalSecretStore(dir);
+    const forgejo = Object.values(graph.resources).find((node) => node.type === "forgejo");
+    const serverRef = forgejo?.inputs["server"];
+    const hostId = typeof serverRef === "object" && serverRef !== null && "$ref" in serverRef ? serverRef.$ref : undefined;
+    const hostNode = hostId !== undefined ? graph.resources[hostId] : undefined;
+    if (hostNode === undefined) {
+        return local;
+    }
+    const target = hostTarget(resolveInputs(hostNode.inputs, createStore(), process.env, { lenient: false }));
+    return createLayeredSecretStore([createHostSecretStore(target, ssh), local], { backfill, log });
+};
+//# sourceMappingURL=secret-store.js.map

package/dist/secrets/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAoC,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAalD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAe,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE,CACrD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAiB,EAAE,QAAqB,EAAe,EAAE;IAC3F,IAAI,KAAyC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE;QACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,iBAAiB,2BAA2B,CAAC,CAAC;YACvF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAA2B,CAAC;QAC/E,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC;gBAGD,MAAM,OAAO,CAAC,IAAI,CACd,mCAAmC,iBAAiB,kCAAkC,IAAI,qCAAqC,iBAAiB,cAAc,iBAAiB,QAAQ,iBAAiB,EAAE,CAC7M,CAAC;YACN,CAAC;oBAAS,CAAC;gBACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACpC,MAA8B,EAC9B,OAAiF,EACtE,EAAE;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACf,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,GAAG,CAAC,oCAAoC,GAAG,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;wBACvB,SAAS;oBACb,CAAC;oBACD,IAAI,CAAC;wBACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACjC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,GAAG,CAAC,qCAAqC,GAAG,mBAAmB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACL,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC5B,SAAS,GAAG,IAAI,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,GAAG,CAAC,qCAAqC,GAAG,aAAa,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAChC,KAAwB,EACxB,GAAW,EACX,GAAgB,EAChB,QAAiB,EACjB,GAA8B,EACnB,EAAE;IACb,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,CAAE,SAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1G,OAAO,wBAAwB,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACpG,CAAC,CAAC"}

package/dist/secrets/secrets.command.d.ts

@@ -0,0 +1,6 @@
+import { type ForgejoApi } from "@intentic/providers";
+import { type CommandContext } from "@stricli/core";
+import { type Output } from "../lib/output.js";
+export declare const pushSecrets: (out: Output, artifact: string, api?: ForgejoApi) => Promise<void>;
+export declare const secretsCommand: import("@stricli/core").RouteMap<CommandContext>;
+//# sourceMappingURL=secrets.command.d.ts.map

package/dist/secrets/secrets.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.command.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets.command.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,qBAAqB,CAAC;AAGlE,OAAO,EAA+B,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAGjF,OAAO,EAAgB,KAAK,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA+B7D,eAAO,MAAM,WAAW,GAAU,KAAK,MAAM,EAAE,UAAU,MAAM,EAAE,MAAK,UAAuB,KAAG,OAAO,CAAC,IAAI,CAmE3G,CAAC;AAYF,eAAO,MAAM,cAAc,kDAGzB,CAAC"}

package/dist/secrets/secrets.command.js

@@ -0,0 +1,106 @@
+import { dirname } from "node:path";
+import { forgejoApi } from "@intentic/providers";
+import { collectSecretInventory, readSyncState, secretDigest, writeSyncState } from "@intentic/scaffold";
+import { buildCommand, buildRouteMap } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_FILE, ARTIFACT_PATH, CONFIG_FILE, INTENT_DIR, loadEnvFile, readArtifact, TARGET_DIR } from "../lib/artifact.js";
+import { createOutput } from "../lib/output.js";
+import { version } from "../lib/version.js";
+import { APPLY_WORKFLOW_PATH, applyWorkflowYaml, collectSecretValues, setRepoSecrets, writeWorkflow } from "../pipelines/adopt-pipelines.js";
+import { forgejoIdentity } from "../pipelines/control-plane-sync.js";
+import { readGeneratedSecrets } from "../secrets/generated-secrets.js";
+const entryLine = (entry) => {
+    const requiredBy = entry.requiredBy.length > 0 ? `  → required by ${entry.requiredBy.map((r) => r.resourceId).join(", ")}` : "";
+    const ci = entry.ci === undefined ? "" : `  [CI: ${entry.ci.synced ? "synced" : "out of date"}]`;
+    return `${entry.key}  ${entry.status}  (${entry.kind}, ${entry.storedAt})${requiredBy}${ci}`;
+};
+const list = buildCommand({
+    docs: { brief: "List every secret the workspace knows about — status, consumers, and CI sync state (never values)" },
+    parameters: {
+        flags: { artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` } },
+    },
+    async func(flags) {
+        const out = createOutput(this.process.stdout, loadConfig().intenticOutput);
+        const entries = await collectSecretInventory(dirname(flags.artifact ?? ARTIFACT_PATH));
+        for (const entry of entries) {
+            out.text(entryLine(entry));
+        }
+        out.result({ entries });
+    },
+});
+export const pushSecrets = async (out, artifact, api = forgejoApi) => {
+    const targetDir = dirname(artifact);
+    const sync = await readSyncState(targetDir);
+    if (Object.keys(sync).length === 0) {
+        out.text("not adopted (no CI secret record) — nothing to push");
+        out.result({ pushed: [], reason: "not adopted" });
+        return;
+    }
+    loadEnvFile(targetDir);
+    const graph = await readArtifact(artifact);
+    const { domain, user, adminPasswordRef: ref } = forgejoIdentity(graph);
+    const generatedValues = await readGeneratedSecrets(targetDir);
+    const password = ref.source === "generated" ? generatedValues[ref.key] : process.env[ref.key];
+    if (password === undefined || password === "") {
+        throw new Error(`forgejo admin password (${ref.source} secret ${ref.key}) is not available`);
+    }
+    const current = collectSecretValues(graph, process.env, generatedValues);
+    const changed = Object.entries(current).filter(([key, value]) => sync[key]?.digest !== secretDigest(value));
+    const baseUrl = `https://${domain}`;
+    if (changed.length > 0) {
+        await setRepoSecrets({ api, baseUrl, user, password, owner: user, name: TARGET_DIR, secrets: Object.fromEntries(changed) });
+        const cloudflare = changed.find(([key]) => key === "CLOUDFLARE_API_TOKEN");
+        if (cloudflare !== undefined) {
+            await setRepoSecrets({
+                api,
+                baseUrl,
+                user,
+                password,
+                owner: user,
+                name: INTENT_DIR,
+                secrets: { CLOUDFLARE_API_TOKEN: cloudflare[1] },
+            });
+        }
+    }
+    const keySetChanged = Object.keys(current).some((key) => sync[key] === undefined);
+    if (keySetChanged) {
+        const inputs = {
+            cliVersion: version,
+            user,
+            domain,
+            configFile: CONFIG_FILE,
+            artifactFile: ARTIFACT_FILE,
+            intentRepo: INTENT_DIR,
+            desiredStateRepo: TARGET_DIR,
+            applySecretKeys: Object.keys(current).toSorted(),
+            forgejoPasswordKey: ref.key,
+        };
+        await writeWorkflow(targetDir, APPLY_WORKFLOW_PATH, applyWorkflowYaml(inputs));
+        out.text(`regenerated ${APPLY_WORKFLOW_PATH} for the new key set — commit and push desired-state to activate it`);
+    }
+    const pushedAt = new Date().toISOString();
+    await writeSyncState(targetDir, {
+        ...sync,
+        ...Object.fromEntries(changed.map(([key, value]) => [key, { digest: secretDigest(value), pushedAt }])),
+    });
+    const pushed = changed.map(([key]) => key).toSorted();
+    const skipped = Object.keys(current)
+        .filter((key) => !pushed.includes(key))
+        .toSorted();
+    out.text(pushed.length > 0 ? `pushed ${pushed.length} secret(s) to ${user}/${TARGET_DIR}: ${pushed.join(", ")}` : "CI secrets already in sync");
+    out.result({ pushed, skipped });
+};
+const push = buildCommand({
+    docs: { brief: "Push changed secret values to the provisioned Forgejo's Actions secrets (no-op before adopt)" },
+    parameters: {
+        flags: { artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` } },
+    },
+    async func(flags) {
+        await pushSecrets(createOutput(this.process.stdout, loadConfig().intenticOutput), flags.artifact ?? ARTIFACT_PATH);
+    },
+});
+export const secretsCommand = buildRouteMap({
+    routes: { list, push },
+    docs: { brief: "Inspect and sync the workspace's secrets (keys and status only — values never print)" },
+});
+//# sourceMappingURL=secrets.command.js.map

package/dist/secrets/secrets.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.command.js","sourceRoot":"","sources":["../../src/secrets/secrets.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAmB,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,sBAAsB,EAAE,aAAa,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACzG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAuB,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,YAAY,EAAe,MAAM,kBAAkB,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,mBAAmB,EAAuB,cAAc,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAClK,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAEvE,MAAM,SAAS,GAAG,CAAC,KAA2B,EAAU,EAAE;IACtD,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,mBAAmB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC;IACjG,OAAO,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,QAAQ,IAAI,UAAU,GAAG,EAAE,EAAE,CAAC;AACjG,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,YAAY,CAAwB;IAC7C,IAAI,EAAE,EAAE,KAAK,EAAE,mGAAmG,EAAE;IACpH,UAAU,EAAE;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE,EAAE;KACpI;IACD,KAAK,CAAC,IAAI,CAAuB,KAA4B;QACzD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,CAAC;QACvF,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;QACD,GAAG,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAC5B,CAAC;CACJ,CAAC,CAAC;AAMH,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,GAAW,EAAE,QAAgB,EAAE,MAAkB,UAAU,EAAiB,EAAE;IAC5G,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,GAAG,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAClD,OAAO;IACX,CAAC;IACD,WAAW,CAAC,SAAS,CAAC,CAAC;IACvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9F,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,KAAK,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,MAAM,OAAO,GAAG,WAAW,MAAM,EAAE,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAE5H,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,sBAAsB,CAAC,CAAC;QAC3E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,cAAc,CAAC;gBACjB,GAAG;gBACH,OAAO;gBACP,IAAI;gBACJ,QAAQ;gBACR,KAAK,EAAE,IAAI;gBACX,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,EAAE,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE;aACnD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAID,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC;IAClF,IAAI,aAAa,EAAE,CAAC;QAChB,MAAM,MAAM,GAAmB;YAC3B,UAAU,EAAE,OAAO;YACnB,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,UAAU;YACtB,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;YAChD,kBAAkB,EAAE,GAAG,CAAC,GAAG;SAC9B,CAAC;QACF,MAAM,aAAa,CAAC,SAAS,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;QAC/E,GAAG,CAAC,IAAI,CAAC,eAAe,mBAAmB,qEAAqE,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,cAAc,CAAC,SAAS,EAAE;QAC5B,GAAG,IAAI;QACP,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;KACzG,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC;SAC/B,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;SACtC,QAAQ,EAAE,CAAC;IAChB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,MAAM,iBAAiB,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC;IAChJ,GAAG,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACpC,CAAC,CAAC;AAEF,MAAM,IAAI,GAAG,YAAY,CAAwB;IAC7C,IAAI,EAAE,EAAE,KAAK,EAAE,8FAA8F,EAAE;IAC/G,UAAU,EAAE;QACR,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE,EAAE;KACpI;IACD,KAAK,CAAC,IAAI,CAAuB,KAA4B;QACzD,MAAM,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC;IACvH,CAAC;CACJ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;IACxC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;IACtB,IAAI,EAAE,EAAE,KAAK,EAAE,sFAAsF,EAAE;CAC1G,CAAC,CAAC"}

package/dist/secrets/secrets.d.ts

@@ -0,0 +1,7 @@
+import { type DesiredStateGraph } from "@intentic/graph";
+export declare const collectSecrets: (graph: DesiredStateGraph) => {
+    readonly env: string[];
+    readonly generated: string[];
+};
+export declare const writeEnvExample: (path: string, keys: readonly string[]) => Promise<void>;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAK7E,eAAO,MAAM,cAAc,GAAI,OAAO,iBAAiB,KAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CAM/G,CAAC;AAIF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAEzF,CAAC"}

package/dist/secrets/secrets.js

@@ -0,0 +1,14 @@
+import { writeFile } from "node:fs/promises";
+import { collectSecretUsage } from "@intentic/graph";
+import { renderTemplate } from "../lib/templates.js";
+export const collectSecrets = (graph) => {
+    const usage = collectSecretUsage(graph);
+    return {
+        env: usage.filter((u) => u.source === "env").map((u) => u.key),
+        generated: usage.filter((u) => u.source === "generated").map((u) => u.key),
+    };
+};
+export const writeEnvExample = async (path, keys) => {
+    await writeFile(path, renderTemplate("env-example", { keys }));
+};
+//# sourceMappingURL=secrets.js.map

package/dist/secrets/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,kBAAkB,EAA0B,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAIrD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAA4D,EAAE;IACjH,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACxC,OAAO;QACH,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9D,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;KAC7E,CAAC;AACN,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,IAAuB,EAAiB,EAAE;IAC1F,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC"}

package/package.json

@@ -0,0 +1,69 @@
+{
+  "name": "@intentic/cli",
+  "version": "1.0.2",
+  "description": "",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitlab.com/radarsu/intentic.git",
+    "directory": "_apps/cli"
+  },
+  "files": [
+    "dist",
+    "templates"
+  ],
+  "bin": {
+    "intentic": "./dist/cli.js"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org/"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "@intentic/src": "./src/index.ts",
+        "default": "./dist/index.js"
+      }
+    }
+  },
+  "dependencies": {
+    "@puristic/env": "1.4.1",
+    "@stricli/core": "1.2.8",
+    "eta": "4.6.0",
+    "tslib": "2.8.1",
+    "zod": "4.4.3",
+    "@intentic/engine": "1.0.2",
+    "@intentic/graph": "1.0.2",
+    "@intentic/need-resolver": "1.0.2",
+    "@intentic/providers": "1.0.2",
+    "@intentic/sandbox-contract": "1.0.2",
+    "@intentic/scaffold": "0.0.0",
+    "@intentic/state-resolver": "1.0.2"
+  },
+  "devDependencies": {
+    "@types/node": "24.13.2",
+    "@types/ssh2": "1.15.5",
+    "ssh2": "1.17.0",
+    "testcontainers": "12.0.3",
+    "typescript": "5.9.3",
+    "vitest": "4.1.9",
+    "yaml": "2.9.0",
+    "@intentic/sdk": "1.0.2",
+    "@intentic/tsconfig": "0.0.0"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --build --watch",
+    "watch": "tsc --build --watch",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "e2e": "INTENTIC_E2E=1 vitest run cli.e2e"
+  }
+}

package/templates/access.md.eta

@@ -0,0 +1,21 @@
+# Access
+
+Generated by `intentic apply`. User-supplied passwords are the values you set in `.env`; generated passwords are stored in `.secrets.json` (gitignored).
+<% if (it.services.length > 0) { -%>
+
+| Service | URL | Username | Password |
+| --- | --- | --- | --- |
+<% it.services.forEach(function (service) { -%>
+| <%= service.label %> | <%= service.url %> | <%= service.username %> | <%= service.password %> |
+<% }) -%>
+<% } -%>
+<% if (it.apps.length > 0) { -%>
+
+## App environments
+
+| Environment | URL |
+| --- | --- |
+<% it.apps.forEach(function (app) { -%>
+| <%= app.id %> | <%= app.url %> |
+<% }) -%>
+<% } -%>

package/templates/demo/Dockerfile.eta

@@ -0,0 +1,5 @@
+FROM busybox:1.37.0
+RUN mkdir -p /www && printf '%s' '<%= it.appBody %>' > /www/index.html
+ENV PORT=8080
+EXPOSE 8080
+CMD ["sh","-c","httpd -f -v -p ${PORT} -h /www"]

package/templates/demo/deploy.config.ts.eta

@@ -0,0 +1,23 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const host = i.have.host("host", {
+        address: "127.0.0.1",
+        user: "root",
+        sshKey: env("HOST_SSH_KEY"),
+        port: <%= it.sshPort %>,
+    });
+
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    i.want.app("<%= it.app %>", {
+        on: host,
+        expose: cf,
+        environments: {
+            <%= it.env %>: { domain: "<%= it.domain %>", branch: "main", env: { PORT: "<%= it.appPort %>" } },
+        },
+    });
+});

package/templates/demo/env.eta

@@ -0,0 +1,2 @@
+HOST_SSH_KEY="<%= it.privateKey %>"
+CLOUDFLARE_API_TOKEN=<%= it.apiToken %>

package/templates/env-example.eta

@@ -0,0 +1,6 @@
+# Secrets required by desired-state.json. Copy this file to .env and fill in each value.
+# Regenerated by `intentic resolve`.
+
+<% it.keys.forEach(function (key) { -%>
+<%= key %>=
+<% }) -%>

package/templates/scaffold/Dockerfile.eta

@@ -0,0 +1,7 @@
+# intentic starter Dockerfile — replace with your app's real build.
+FROM node:24.18.0-alpine3.24
+WORKDIR /app
+COPY . .
+ENV PORT=8080
+EXPOSE 8080
+CMD ["node", "server.js"]

package/templates/scaffold/deploy.config.selfhost.ts.eta

@@ -0,0 +1,18 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    // `self` is your local deploy target (this machine / its Docker-in-Docker host). intentic registers it in
+    // the managed `// <intentic>` block at the top of this file — reference it with `on: self`, don't redeclare it.
+    i.want.app("my-app", {
+        on: self,
+        expose: cf,
+        environments: {
+            production: { domain: "app.<%= it.zone %>", branch: "main" },
+        },
+    });
+});

package/templates/scaffold/deploy.config.ts.eta

@@ -0,0 +1,22 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const host = i.have.host("host", {
+        address: "203.0.113.10",
+        user: "deploy",
+        sshKey: env("HOST_SSH_KEY"),
+    });
+
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    i.want.app("my-app", {
+        on: host,
+        expose: cf,
+        environments: {
+            production: { domain: "app.example.com", branch: "main", env: { DATABASE_URL: env("PRODUCTION_DATABASE_URL") } },
+        },
+    });
+});

package/templates/scaffold/server.js.eta

@@ -0,0 +1,9 @@
+import { createServer } from "node:http";
+
+// Komodo sets PORT in production; the sandbox's app process manager injects PORT for the live preview.
+const port = Number(process.env.PORT ?? 3000);
+
+createServer((_req, res) => {
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end("<!doctype html><title>intentic app</title><h1>It works 🎉</h1><p>Edit <code>server.js</code> — the agent works on this repo.</p>");
+}).listen(port, () => console.log(`app listening on :${port}`));

package/templates/workflows/apply.yaml.eta

@@ -0,0 +1,28 @@
+# Generated by intentic: apply the desired-state artifact, pruning resources it no longer declares.
+on:
+  push:
+    branches: [ "main" ]
+    paths: [ "<%= it.artifactFile %>" ]
+jobs:
+  apply:
+    runs-on: docker
+    env:
+<% it.envEntries.forEach(function (entry) { -%>
+      <%= entry.env %>: ${{ secrets.<%= entry.secret %> }}
+<% }) -%>
+    steps:
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - name: apply and prune
+        run: |
+          corepack enable
+          PREV=''
+          if git rev-parse -q --verify refs/tags/<%= it.appliedTag %> >/dev/null; then \
+            git show <%= it.appliedTag %>:<%= it.artifactFile %> > /tmp/previous.json && PREV="--previous /tmp/previous.json"; fi
+          pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> apply --artifact <%= it.artifactFile %> $PREV
+      - name: mark applied
+        run: |
+          AUTH="$(printf '%s:%s' '<%= it.user %>' "$<%= it.forgejoPasswordKey %>" | base64 -w0)"
+          git tag -f <%= it.appliedTag %> HEAD
+          git -c http.extraHeader="Authorization: basic $AUTH" push -f origin refs/tags/<%= it.appliedTag %>

package/templates/workflows/resolve.yaml.eta

@@ -0,0 +1,26 @@
+# Generated by intentic: resolve deploy.config.ts and push the new artifact into the desired-state repo.
+on:
+  push:
+    branches: [ "main" ]
+    paths: [ "<%= it.configFile %>", "package.json", "pnpm-lock.yaml" ]
+jobs:
+  resolve:
+    runs-on: docker
+    env:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      <%= it.gitUserEnv %>: ${{ secrets.<%= it.gitUserSecret %> }}
+      <%= it.gitTokenEnv %>: ${{ secrets.<%= it.gitTokenSecret %> }}
+    steps:
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: resolve and push desired-state
+        run: |
+          corepack enable
+          pnpm install --ignore-workspace
+          AUTH="$(printf '%s:%s' "$GIT_USER" "$GIT_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $AUTH" clone <%= it.desiredStateCloneUrl %> /tmp/ds
+          pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> resolve --config <%= it.configFile %> --out /tmp/ds/<%= it.artifactFile %> --sync-control-plane
+          cd /tmp/ds
+          git add -A
+          if git diff --cached --quiet; then echo 'desired-state unchanged'; exit 0; fi
+          git -c user.name="<%= it.user %>" -c user.email="<%= it.user %>@<%= it.domain %>" commit -m "intentic resolve"
+          git -c http.extraHeader="Authorization: basic $AUTH" push origin HEAD:main