@intentic/cli 1.32.2 → 1.38.0

package/dist/{resolve.js → resolve/resolve.js}

@@ -2,7 +2,7 @@ import { resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { cloudflareApi } from "@intentic/providers";
 import { collectDomains, selectZone } from "@intentic/state-resolver";
-import { loadEnvFile } from "./artifact.js";
+import { loadEnvFile } from "../lib/artifact.js";
 export const loadIntent = async (configPath) => {
     const loaded = (await import(pathToFileURL(resolve(configPath)).href));
     if (loaded.intent === undefined) {

package/dist/resolve/resolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKjD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAkB,EAAsB,EAAE;IACvE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAA2B,CAAC;IACjG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACzB,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAiB,EAAE,GAAW,EAA+B,EAAE;IAC9F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,8FAA8F,CAAC,CAAC;IACpI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,UAAU,CACb,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,cAAc,CAAC,MAAM,CAAC,CACzB,CAAC;AACN,CAAC,CAAC"}

package/dist/restore/restore.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const restore: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=restore.command.d.ts.map

package/dist/restore/restore.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.command.d.ts","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAGA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAelE,eAAO,MAAM,OAAO,iDA0DlB,CAAC"}

package/dist/restore/restore.command.js

@@ -0,0 +1,67 @@
+import { dirname } from "node:path";
+import { createStore, resolveInputs } from "@intentic/engine";
+import { createSshExecutor, hostTarget, restoreBackup } from "@intentic/providers";
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { ARTIFACT_PATH, loadEnvFile, readArtifact } from "../lib/artifact.js";
+import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { createOutput } from "../lib/output.js";
+import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { generatedSecretStore } from "../secrets/secret-store.js";
+import { collectSecrets } from "../secrets/secrets.js";
+export const restore = buildCommand({
+    docs: { brief: "Restore Forgejo/Komodo from a restic backup snapshot, then re-apply (one-shot recovery)" },
+    parameters: {
+        flags: {
+            artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` },
+            snapshot: { kind: "parsed", parse: String, optional: true, brief: "restic snapshot id to restore (default: latest)" },
+            only: { kind: "parsed", parse: String, optional: true, brief: "Which to restore: forgejo | komodo | all (default: all)" },
+        },
+    },
+    async func(flags) {
+        const out = createOutput(this.process.stdout, loadConfig().intenticOutput);
+        const artifact = flags.artifact ?? ARTIFACT_PATH;
+        const dir = dirname(artifact);
+        loadEnvFile(dir);
+        const graph = await readArtifact(artifact);
+        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, false, out.log), collectSecrets(graph).generated, process.env);
+        const backupNode = Object.values(graph.resources).find((node) => node.type === "backup");
+        if (backupNode === undefined) {
+            throw new Error("no backup resource in the artifact — declare one with i.have.backup and apply it first");
+        }
+        const scope = flags.only ?? "all";
+        if (scope !== "forgejo" && scope !== "komodo" && scope !== "all") {
+            throw new Error(`--only must be one of forgejo|komodo|all, got "${scope}"`);
+        }
+        const resolved = resolveInputs(backupNode.inputs, createStore(), process.env, { lenient: false });
+        const repo = resolved["repo"];
+        const password = resolved["password"];
+        const image = resolved["image"];
+        if (typeof repo !== "string" || typeof password !== "string" || typeof image !== "string") {
+            throw new Error("backup resource is missing its repo/password/image inputs");
+        }
+        const credsRaw = resolved["credentials"];
+        const credentials = {};
+        if (typeof credsRaw === "object" && credsRaw !== null) {
+            for (const [key, value] of Object.entries(credsRaw)) {
+                if (typeof value === "string") {
+                    credentials[key] = value;
+                }
+            }
+        }
+        await restoreBackup({
+            target: hostTarget(resolved),
+            image,
+            repo,
+            password,
+            credentials,
+            snapshot: flags.snapshot ?? "latest",
+            scope: scope,
+            log: out.log,
+            executor: ssh,
+        });
+        out.result({ snapshot: flags.snapshot ?? "latest", scope });
+    },
+});
+//# sourceMappingURL=restore.command.js.map

package/dist/restore/restore.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restore.command.js","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAqB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAe;IAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,yFAAyF,EAAE;IAC1G,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iDAAiD,EAAE;YACrH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,yDAAyD,EAAE;SAC5H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAG3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAClI,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CAAC,wFAAwF,CAAC,CAAC;QAC9G,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;QAClC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC;YAC/D,MAAM,IAAI,KAAK,CAAC,kDAAkD,KAAK,GAAG,CAAC,CAAC;QAChF,CAAC;QAGD,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzC,MAAM,WAAW,GAA2B,EAAE,CAAC;QAC/C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBAC5B,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBAC7B,CAAC;YACL,CAAC;QACL,CAAC;QACD,MAAM,aAAa,CAAC;YAChB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;YAC5B,KAAK;YACL,IAAI;YACJ,QAAQ;YACR,WAAW;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;YACpC,KAAK,EAAE,KAAqB;YAC5B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,QAAQ,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;CACJ,CAAC,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.command.d.ts

@@ -0,0 +1,3 @@
+import { type CommandContext } from "@stricli/core";
+export declare const sandboxTunnel: import("@stricli/core").Command<CommandContext>;
+//# sourceMappingURL=sandbox-tunnel.command.d.ts.map

package/dist/sandbox-tunnel/sandbox-tunnel.command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.command.d.ts","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAQlE,eAAO,MAAM,aAAa,iDA4CxB,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.command.js

@@ -0,0 +1,48 @@
+import { buildCommand } from "@stricli/core";
+import { loadConfig } from "../env.config.js";
+import { createSandboxTunnel } from "./sandbox-tunnel.js";
+export const sandboxTunnel = buildCommand({
+    docs: { brief: "Create/refresh the per-sandbox Cloudflare tunnel + DNS and print its connector token (used by connect.sh)" },
+    parameters: {
+        flags: {
+            service: {
+                kind: "parsed",
+                parse: String,
+                brief: "Internal service URL the tunnel routes to (e.g. http://intentic-sandbox-workspace:8787)",
+            },
+            previewService: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Dev-server URL to route the *.preview.<zone> wildcard to (e.g. http://intentic-sandbox-workspace:5173)",
+            },
+            zone: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: "Cloudflare zone for the DNS record (default: the API token's sole zone, or set ZONE)",
+            },
+        },
+    },
+    async func(flags) {
+        const config = loadConfig();
+        const { cloudflareApiToken: apiToken, connectToken } = config;
+        if (apiToken === "") {
+            throw new Error("set CLOUDFLARE_API_TOKEN");
+        }
+        if (connectToken === "") {
+            throw new Error("set CONNECT_TOKEN (the per-sandbox connection token)");
+        }
+        const zone = flags.zone ?? (config.zone !== "" ? config.zone : undefined);
+        const { token, hostname } = await createSandboxTunnel({
+            apiToken,
+            connectToken,
+            service: flags.service,
+            ...(flags.previewService !== undefined && flags.previewService !== "" ? { previewService: flags.previewService } : {}),
+            ...(zone !== undefined && zone !== "" ? { zone } : {}),
+            log: (message) => this.process.stderr.write(`${message}\n`),
+        });
+        this.process.stdout.write(`TUNNEL_TOKEN=${token}\nSANDBOX_HOSTNAME=${hostname}\n`);
+    },
+});
+//# sourceMappingURL=sandbox-tunnel.command.js.map

package/dist/sandbox-tunnel/sandbox-tunnel.command.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.command.js","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAM1D,MAAM,CAAC,MAAM,aAAa,GAAG,YAAY,CAA8D;IACnG,IAAI,EAAE,EAAE,KAAK,EAAE,2GAA2G,EAAE;IAC5H,UAAU,EAAE;QACR,KAAK,EAAE;YACH,OAAO,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,KAAK,EAAE,yFAAyF;aACnG;YACD,cAAc,EAAE;gBACZ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,wGAAwG;aAClH;YACD,IAAI,EAAE;gBACF,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,sFAAsF;aAChG;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAkE;QAC/F,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAC5B,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,MAAM,CAAC;QAC9D,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,YAAY,KAAK,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1E,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,mBAAmB,CAAC;YAClD,QAAQ;YACR,YAAY;YACZ,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC;SAC9D,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,KAAK,sBAAsB,QAAQ,IAAI,CAAC,CAAC;IACvF,CAAC;CACJ,CAAC,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.d.ts","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAiB,MAAM,qBAAqB,CAAC;AAGxE,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC7B;AAMD,eAAO,MAAM,mBAAmB,GAAU,MAAM;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;CAChC,KAAG,OAAO,CAAC,mBAAmB,CAsB9B,CAAC"}

package/dist/sandbox-tunnel/sandbox-tunnel.js

@@ -0,0 +1,27 @@
+import { createHash } from "node:crypto";
+import { cloudflareApi } from "@intentic/providers";
+import { CATCH_ALL, resolveZone, upsertCname } from "../lib/cf-tunnel.js";
+export const createSandboxTunnel = async (args) => {
+    const { apiToken, connectToken, service, previewService, log } = args;
+    const api = args.api ?? cloudflareApi;
+    const zone = await resolveZone(api, apiToken, args.zone);
+    const id = createHash("sha256").update(connectToken).digest("hex").slice(0, 12);
+    const name = `sandbox-${id}`;
+    const hostname = `${name}.${zone.name}`;
+    const previewHostname = `*.preview.${zone.name}`;
+    const withPreview = previewService !== undefined && previewService !== "";
+    log(`resolving tunnel "${name}" on zone "${zone.name}"…`);
+    const existing = await api.findTunnel({ accountId: zone.accountId, apiToken, name });
+    const tunnel = existing ?? (await api.createTunnel({ accountId: zone.accountId, apiToken, name }));
+    const token = await api.getTunnelToken({ accountId: zone.accountId, apiToken, tunnelId: tunnel.id });
+    const ingress = [{ hostname, service }, ...(withPreview ? [{ hostname: previewHostname, service: previewService }] : []), CATCH_ALL];
+    await api.putTunnelIngress({ accountId: zone.accountId, apiToken, tunnelId: tunnel.id, ingress });
+    const cname = `${tunnel.id}.cfargotunnel.com`;
+    await upsertCname(api, apiToken, zone.id, hostname, cname, "intentic sandbox tunnel");
+    if (withPreview) {
+        await upsertCname(api, apiToken, zone.id, previewHostname, cname, "intentic sandbox tunnel");
+    }
+    log(`tunnel "${name}" → ${hostname} ready`);
+    return { token, hostname };
+};
+//# sourceMappingURL=sandbox-tunnel.js.map

package/dist/sandbox-tunnel/sandbox-tunnel.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-tunnel.js","sourceRoot":"","sources":["../../src/sandbox-tunnel/sandbox-tunnel.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAsB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAW1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,KAAK,EAAE,IASzC,EAAgC,EAAE;IAC/B,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IACzD,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChF,MAAM,IAAI,GAAG,WAAW,EAAE,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,aAAa,IAAI,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,EAAE,CAAC;IAC1E,GAAG,CAAC,qBAAqB,IAAI,cAAc,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAG,MAAM,GAAG,CAAC,cAAc,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IACrI,MAAM,GAAG,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;IAClG,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC9C,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACtF,IAAI,WAAW,EAAE,CAAC;QACd,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,yBAAyB,CAAC,CAAC;IACjG,CAAC;IACD,GAAG,CAAC,WAAW,IAAI,OAAO,QAAQ,QAAQ,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC,CAAC"}

package/dist/secrets/generated-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAcrD,eAAO,MAAM,sBAAsB,GAAU,OAAO,WAAW,EAAE,MAAM,SAAS,MAAM,EAAE,EAAE,KAAK,UAAU,KAAG,OAAO,CAAC,IAAI,CAcvH,CAAC;AAKF,eAAO,MAAM,oBAAoB,GAAU,KAAK,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtF,CAAC"}

package/dist/{generated-secrets.js → secrets/generated-secrets.js}

@@ -2,7 +2,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
-import { SECRETS_FILE } from "./artifact.js";
+import { SECRETS_FILE } from "../lib/artifact.js";
 const generate = () => randomBytes(16).toString("hex");
 export const ensureGeneratedSecrets = async (store, keys, env) => {
     for (const key of keys) {

package/dist/secrets/generated-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generated-secrets.js","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAU/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAkB,EAAE,IAAuB,EAAE,GAAe,EAAiB,EAAE;IACxH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC,CAAC"}

package/dist/{secret-store.d.ts → secrets/secret-store.d.ts}

@@ -1,4 +1,5 @@
-import type { SshExecutor, SshTarget } from "@intentic/providers";
+import type { DesiredStateGraph } from "@intentic/graph";
+import { type SshExecutor, type SshTarget } from "@intentic/providers";
 export interface SecretStore {
     readonly get: (key: string) => Promise<string | undefined>;
     readonly set: (key: string, value: string) => Promise<void>;
@@ -9,4 +10,5 @@ export declare const createLayeredSecretStore: (layers: readonly SecretStore[],
     readonly backfill: boolean;
     readonly log?: (message: string) => void;
 }) => SecretStore;
+export declare const generatedSecretStore: (graph: DesiredStateGraph, dir: string, ssh: SshExecutor, backfill: boolean, log: (message: string) => void) => SecretStore;
 //# sourceMappingURL=secret-store.d.ts.map

package/dist/secrets/secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.d.ts","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAc,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAOnF,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC3D,QAAQ,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/D;AAID,eAAO,MAAM,sBAAsB,GAAI,KAAK,MAAM,KAAG,WAYpD,CAAC;AAOF,eAAO,MAAM,qBAAqB,GAAI,QAAQ,SAAS,EAAE,UAAU,WAAW,KAAG,WAiChF,CAAC;AAOF,eAAO,MAAM,wBAAwB,GACjC,QAAQ,SAAS,WAAW,EAAE,EAC9B,SAAS;IAAE,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,KAClF,WA2CF,CAAC;AAUF,eAAO,MAAM,oBAAoB,GAC7B,OAAO,iBAAiB,EACxB,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,UAAU,OAAO,EACjB,KAAK,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC/B,WAYF,CAAC"}

package/dist/{secret-store.js → secrets/secret-store.js}

@@ -1,7 +1,9 @@
 import { existsSync } from "node:fs";
 import { readFile, writeFile } from "node:fs/promises";
 import { join } from "node:path";
-import { SECRETS_FILE } from "./artifact.js";
+import { createStore, resolveInputs } from "@intentic/engine";
+import { hostTarget } from "@intentic/providers";
+import { SECRETS_FILE } from "../lib/artifact.js";
 export const createLocalSecretStore = (dir) => {
     const path = join(dir, SECRETS_FILE);
     const read = async () => existsSync(path) ? JSON.parse(await readFile(path, "utf8")) : {};
@@ -94,4 +96,16 @@ export const createLayeredSecretStore = (layers, options) => {
         },
     };
 };
+export const generatedSecretStore = (graph, dir, ssh, backfill, log) => {
+    const local = createLocalSecretStore(dir);
+    const forgejo = Object.values(graph.resources).find((node) => node.type === "forgejo");
+    const serverRef = forgejo?.inputs["server"];
+    const hostId = typeof serverRef === "object" && serverRef !== null && "$ref" in serverRef ? serverRef.$ref : undefined;
+    const hostNode = hostId !== undefined ? graph.resources[hostId] : undefined;
+    if (hostNode === undefined) {
+        return local;
+    }
+    const target = hostTarget(resolveInputs(hostNode.inputs, createStore(), process.env, { lenient: false }));
+    return createLayeredSecretStore([createHostSecretStore(target, ssh), local], { backfill, log });
+};
 //# sourceMappingURL=secret-store.js.map

package/dist/secrets/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../../src/secrets/secret-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAE9D,OAAO,EAAE,UAAU,EAAoC,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAalD,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAW,EAAe,EAAE;IAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE,CACrD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;IACjG,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvF,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAMF,MAAM,iBAAiB,GAAG,4BAA4B,CAAC;AACvD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,MAAiB,EAAE,QAAqB,EAAe,EAAE;IAC3F,IAAI,KAAyC,CAAC;IAC9C,MAAM,IAAI,GAAG,KAAK,IAAqC,EAAE;QACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,iBAAiB,2BAA2B,CAAC,CAAC;YACvF,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAA2B,CAAC;QAC/E,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC,CAAC;IACF,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC;QACvC,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,MAAM,KAAK,GAAG,MAAM,IAAI,EAAE,CAAC;YAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACnB,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;YACjD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC;gBAGD,MAAM,OAAO,CAAC,IAAI,CACd,mCAAmC,iBAAiB,kCAAkC,IAAI,qCAAqC,iBAAiB,cAAc,iBAAiB,QAAQ,iBAAiB,EAAE,CAC7M,CAAC;YACN,CAAC;oBAAS,CAAC;gBACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;YAC5B,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CACpC,MAA8B,EAC9B,OAAiF,EACtE,EAAE;IACb,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,OAAO;QACH,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACf,MAAM,MAAM,GAA2B,EAAE,CAAC;YAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;gBACtC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,GAAG,CAAC,oCAAoC,GAAG,0BAA0B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACtF,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,CAAC;YACL,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;YAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;oBACxC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC;wBACvB,SAAS;oBACb,CAAC;oBACD,IAAI,CAAC;wBACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;oBACjC,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACb,GAAG,CAAC,qCAAqC,GAAG,mBAAmB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBACpF,CAAC;gBACL,CAAC;YACL,CAAC;YACD,OAAO,MAAM,CAAC;QAClB,CAAC;QACD,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;YACtB,IAAI,SAAS,GAAG,KAAK,CAAC;YACtB,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACD,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;oBAC5B,SAAS,GAAG,IAAI,CAAC;gBACrB,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,GAAG,CAAC,qCAAqC,GAAG,aAAa,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC9E,CAAC;YACL,CAAC;YACD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CAAC,uCAAuC,GAAG,gBAAgB,CAAC,CAAC;YAChF,CAAC;QACL,CAAC;KACJ,CAAC;AACN,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAChC,KAAwB,EACxB,GAAW,EACX,GAAgB,EAChB,QAAiB,EACjB,GAA8B,EACnB,EAAE;IACb,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IACvF,MAAM,SAAS,GAAG,OAAO,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,MAAM,GACR,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,IAAI,SAAS,CAAC,CAAC,CAAE,SAAuC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3I,MAAM,QAAQ,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC1G,OAAO,wBAAwB,CAAC,CAAC,qBAAqB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;AACpG,CAAC,CAAC"}

package/dist/secrets/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAMxF,eAAO,MAAM,SAAS,GAAI,OAAO,eAAe,GAAG,SAAS,KAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAaxH,CAAC;AAOF,eAAO,MAAM,cAAc,GAAI,OAAO,iBAAiB,KAAG;IAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,CAAA;CA6B/G,CAAC;AAIF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,MAAM,SAAS,MAAM,EAAE,KAAG,OAAO,CAAC,IAAI,CAEzF,CAAC"}

package/dist/{secrets.js → secrets/secrets.js}

@@ -1,4 +1,5 @@
 import { writeFile } from "node:fs/promises";
+import { renderTemplate } from "../lib/templates.js";
 export const secretRef = (value) => {
     if (typeof value !== "object" || value === null || Array.isArray(value)) {
         return undefined;
@@ -43,11 +44,6 @@ export const collectSecrets = (graph) => {
     return { env: bucket("env"), generated: bucket("generated") };
 };
 export const writeEnvExample = async (path, keys) => {
-    const header = [
-        "# Secrets required by desired-state.json. Copy this file to .env and fill in each value.",
-        "# Regenerated by `intentic resolve`.",
-        "",
-    ];
-    await writeFile(path, [...header, ...keys.map((key) => `${key}=`), ""].join("\n"));
+    await writeFile(path, renderTemplate("env-example", { keys }));
 };
 //# sourceMappingURL=secrets.js.map

package/dist/secrets/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/secrets/secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAKrD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAkC,EAAuE,EAAE;IACjI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtE,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAI,KAA2D,CAAC,OAAO,CAAC;IACpF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAC/B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,WAAW,CAAC,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC,CAAC;AAOF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,KAAwB,EAA4D,EAAE;IACjH,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAC;IAChD,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAQ,EAAE;QAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpB,OAAO;QACX,CAAC;QACD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAClC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,WAAW,GAAG,CAAC,GAAG,yBAAyB,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACjC,OAAO;QACX,CAAC;QACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC;IACL,CAAC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAY,EAAE,CAC9C,CAAC,GAAG,OAAO,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC;SAC/B,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,EAAE,CAAC;IAChB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;AAClE,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,IAAuB,EAAiB,EAAE;IAC1F,MAAM,SAAS,CAAC,IAAI,EAAE,cAAc,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/cli",
-  "version": "1.32.2",
+  "version": "1.38.0",
   "description": "",
   "license": "MIT",
   "type": "module",
@@ -10,7 +10,8 @@
     "directory": "_apps/cli"
   },
   "files": [
-    "dist"
+    "dist",
+    "templates"
   ],
   "bin": {
     "intentic": "./dist/cli.js"
@@ -33,13 +34,17 @@
     }
   },
   "dependencies": {
+    "@puristic/env": "1.4.1",
     "@stricli/core": "1.2.8",
+    "eta": "4.6.0",
     "tslib": "2.8.1",
-    "@intentic/engine": "1.32.2",
-    "@intentic/graph": "1.32.2",
-    "@intentic/need-resolver": "1.32.2",
-    "@intentic/providers": "1.32.2",
-    "@intentic/state-resolver": "1.32.2"
+    "zod": "4.4.3",
+    "@intentic/engine": "1.38.0",
+    "@intentic/need-resolver": "1.38.0",
+    "@intentic/graph": "1.38.0",
+    "@intentic/providers": "1.38.0",
+    "@intentic/scaffold": "0.0.0",
+    "@intentic/state-resolver": "1.38.0"
   },
   "devDependencies": {
     "@types/node": "24.13.2",
@@ -48,7 +53,8 @@
     "testcontainers": "12.0.3",
     "typescript": "5.9.3",
     "vitest": "4.1.9",
-    "@intentic/sdk": "1.32.2",
+    "yaml": "2.9.0",
+    "@intentic/sdk": "1.38.0",
     "@intentic/tsconfig": "0.0.0"
   },
   "scripts": {

package/templates/access.md.eta

@@ -0,0 +1,21 @@
+# Access
+
+Generated by `intentic apply`. User-supplied passwords are the values you set in `.env`; generated passwords are stored in `.secrets.json` (gitignored).
+<% if (it.services.length > 0) { -%>
+
+| Service | URL | Username | Password |
+| --- | --- | --- | --- |
+<% it.services.forEach(function (service) { -%>
+| <%= service.label %> | <%= service.url %> | <%= service.username %> | <%= service.password %> |
+<% }) -%>
+<% } -%>
+<% if (it.apps.length > 0) { -%>
+
+## App environments
+
+| Environment | URL |
+| --- | --- |
+<% it.apps.forEach(function (app) { -%>
+| <%= app.id %> | <%= app.url %> |
+<% }) -%>
+<% } -%>

package/templates/demo/Dockerfile.eta

@@ -0,0 +1,5 @@
+FROM busybox:1.37.0
+RUN mkdir -p /www && printf '%s' '<%= it.appBody %>' > /www/index.html
+ENV PORT=8080
+EXPOSE 8080
+CMD ["sh","-c","httpd -f -v -p ${PORT} -h /www"]

package/templates/demo/deploy.config.ts.eta

@@ -0,0 +1,23 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const host = i.have.host("host", {
+        address: "127.0.0.1",
+        user: "root",
+        sshKey: env("HOST_SSH_KEY"),
+        port: <%= it.sshPort %>,
+    });
+
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    i.want.app("<%= it.app %>", {
+        on: host,
+        expose: cf,
+        environments: {
+            <%= it.env %>: { domain: "<%= it.domain %>", branch: "main", env: { PORT: "<%= it.appPort %>" } },
+        },
+    });
+});

package/templates/demo/env.eta

@@ -0,0 +1,2 @@
+HOST_SSH_KEY="<%= it.privateKey %>"
+CLOUDFLARE_API_TOKEN=<%= it.apiToken %>

package/templates/env-example.eta

@@ -0,0 +1,6 @@
+# Secrets required by desired-state.json. Copy this file to .env and fill in each value.
+# Regenerated by `intentic resolve`.
+
+<% it.keys.forEach(function (key) { -%>
+<%= key %>=
+<% }) -%>

package/templates/scaffold/Dockerfile.eta

@@ -0,0 +1,7 @@
+# intentic starter Dockerfile — replace with your app's real build.
+FROM node:24.18.0-alpine3.24
+WORKDIR /app
+COPY . .
+ENV PORT=8080
+EXPOSE 8080
+CMD ["node", "server.js"]

package/templates/scaffold/deploy.config.selfhost.ts.eta

@@ -0,0 +1,18 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    // `self` is your local deploy target (this machine / its Docker-in-Docker host). intentic registers it in
+    // the managed `// <intentic>` block at the top of this file — reference it with `on: self`, don't redeclare it.
+    i.want.app("my-app", {
+        on: self,
+        expose: cf,
+        environments: {
+            production: { domain: "app.<%= it.zone %>", branch: "main" },
+        },
+    });
+});

package/templates/scaffold/deploy.config.ts.eta

@@ -0,0 +1,22 @@
+import { env } from "@intentic/graph";
+import { defineIntent } from "@intentic/sdk";
+
+export const intent = defineIntent((i) => {
+    const host = i.have.host("host", {
+        address: "203.0.113.10",
+        user: "deploy",
+        sshKey: env("HOST_SSH_KEY"),
+    });
+
+    const cf = i.have.cloudflare("cf", {
+        apiToken: env("CLOUDFLARE_API_TOKEN"),
+    });
+
+    i.want.app("my-app", {
+        on: host,
+        expose: cf,
+        environments: {
+            production: { domain: "app.example.com", branch: "main", env: { DATABASE_URL: env("PRODUCTION_DATABASE_URL") } },
+        },
+    });
+});

package/templates/scaffold/server.js.eta

@@ -0,0 +1,9 @@
+import { createServer } from "node:http";
+
+// Komodo sets PORT in production; the sandbox passes DEV_PORT for the live preview.
+const port = Number(process.env.PORT ?? process.env.DEV_PORT ?? 5173);
+
+createServer((_req, res) => {
+    res.writeHead(200, { "content-type": "text/html; charset=utf-8" });
+    res.end("<!doctype html><title>intentic app</title><h1>It works 🎉</h1><p>Edit <code>server.js</code> — the agent works on this repo.</p>");
+}).listen(port, () => console.log(`app listening on :${port}`));

package/templates/workflows/apply.yaml.eta

@@ -0,0 +1,28 @@
+# Generated by intentic: apply the desired-state artifact, pruning resources it no longer declares.
+on:
+  push:
+    branches: [ "main" ]
+    paths: [ "<%= it.artifactFile %>" ]
+jobs:
+  apply:
+    runs-on: docker
+    env:
+<% it.envEntries.forEach(function (entry) { -%>
+      <%= entry.env %>: ${{ secrets.<%= entry.secret %> }}
+<% }) -%>
+    steps:
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        with:
+          fetch-depth: 0
+      - name: apply and prune
+        run: |
+          corepack enable
+          PREV=''
+          if git rev-parse -q --verify refs/tags/<%= it.appliedTag %> >/dev/null; then \
+            git show <%= it.appliedTag %>:<%= it.artifactFile %> > /tmp/previous.json && PREV="--previous /tmp/previous.json"; fi
+          pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> apply --artifact <%= it.artifactFile %> $PREV
+      - name: mark applied
+        run: |
+          AUTH="$(printf '%s:%s' '<%= it.user %>' "$<%= it.forgejoPasswordKey %>" | base64 -w0)"
+          git tag -f <%= it.appliedTag %> HEAD
+          git -c http.extraHeader="Authorization: basic $AUTH" push -f origin refs/tags/<%= it.appliedTag %>

package/templates/workflows/resolve.yaml.eta

@@ -0,0 +1,26 @@
+# Generated by intentic: resolve deploy.config.ts and push the new artifact into the desired-state repo.
+on:
+  push:
+    branches: [ "main" ]
+    paths: [ "<%= it.configFile %>", "package.json", "pnpm-lock.yaml" ]
+jobs:
+  resolve:
+    runs-on: docker
+    env:
+      CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+      <%= it.gitUserEnv %>: ${{ secrets.<%= it.gitUserSecret %> }}
+      <%= it.gitTokenEnv %>: ${{ secrets.<%= it.gitTokenSecret %> }}
+    steps:
+      - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - name: resolve and push desired-state
+        run: |
+          corepack enable
+          pnpm install --ignore-workspace
+          AUTH="$(printf '%s:%s' "$GIT_USER" "$GIT_TOKEN" | base64 -w0)"
+          git -c http.extraHeader="Authorization: basic $AUTH" clone <%= it.desiredStateCloneUrl %> /tmp/ds
+          pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> resolve --config <%= it.configFile %> --out /tmp/ds/<%= it.artifactFile %> --sync-control-plane
+          cd /tmp/ds
+          git add -A
+          if git diff --cached --quiet; then echo 'desired-state unchanged'; exit 0; fi
+          git -c user.name="<%= it.user %>" -c user.email="<%= it.user %>@<%= it.domain %>" commit -m "intentic resolve"
+          git -c http.extraHeader="Authorization: basic $AUTH" push origin HEAD:main

package/dist/access.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAWvE,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAG3B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACxG;AAKD,eAAO,MAAM,aAAa,GACtB,OAAO,iBAAiB,EACxB,SAAS,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EACpE,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,KAClD,WAAW,EAuBb,CAAC;AAeF,eAAO,MAAM,mBAAmB,GAAI,SAAS,SAAS,WAAW,EAAE,KAAG,MASrE,CAAC;AAWF,eAAO,MAAM,eAAe,GAAU,MAAM,MAAM,EAAE,SAAS,SAAS,WAAW,EAAE,KAAG,OAAO,CAAC,IAAI,CAqBjG,CAAC"}

package/dist/access.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"access.js","sourceRoot":"","sources":["../src/access.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAIzC,MAAM,cAAc,GAAqC;IACrD,OAAO,EAAE,eAAe;IACxB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,wBAAwB;CACnC,CAAC;AAeF,MAAM,CAAC,MAAM,aAAa,GAAG,CACzB,KAAwB,EACxB,OAAoE,EACpE,GAAiD,EACpC,EAAE;IACf,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACxE,SAAS;QACb,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC1B,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACpD,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,QAAQ,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACjI,OAAO,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE;YAC3C,GAAG;YACH,GAAG,CAAC,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClD,CAAC,CAAC;IACP,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAGF,MAAM,eAAe,GAAG,CAAC,QAAiC,EAAU,EAAE;IAClE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,KAAK,KAAK,SAAS;YAC/B,CAAC,CAAC,gBAAgB,QAAQ,CAAC,KAAK,4BAA4B;YAC5D,CAAC,CAAC,8CAA8C,CAAC;IACzD,CAAC;IACD,OAAO,iBAAiB,QAAQ,CAAC,GAAG,EAAE,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAA+B,EAAU,EAAE;IAC3E,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC1B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC,CAAC;AAIF,MAAM,gBAAgB,GAAG,CAAC,QAAiC,EAAU,EAAE;IACnE,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC;AACxG,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,eAAe,GAAG,KAAK,EAAE,IAAY,EAAE,OAA+B,EAAiB,EAAE;IAClG,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG;QACV,UAAU;QACV,EAAE;QACF,0JAA0J;KAC7J,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,yCAAyC,EAAE,2BAA2B,CAAC,CAAC;QACvF,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,KAAK,MAAM,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,QAAQ,MAAM,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9G,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,qBAAqB,EAAE,EAAE,EAAE,uBAAuB,EAAE,eAAe,CAAC,CAAC;QACpF,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,EAAE,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACjD,CAAC;IACL,CAAC;IACD,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC,CAAC"}

package/dist/adopt-pipelines.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"adopt-pipelines.d.ts","sourceRoot":"","sources":["../src/adopt-pipelines.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAItD,eAAO,MAAM,eAAe,sBAAsB,CAAC;AACnD,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAIrD,eAAO,MAAM,YAAY,aAAa,CAAC;AACvC,eAAO,MAAM,aAAa,cAAc,CAAC;AAWzC,eAAO,MAAM,oBAAoB,oCAAoC,CAAC;AACtE,eAAO,MAAM,mBAAmB,kCAAkC,CAAC;AAOnE,eAAO,MAAM,iBAAiB,GAAI,KAAK,MAAM,KAAG,MAC+C,CAAC;AAEhG,MAAM,WAAW,cAAc;IAE3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAGlC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAG5C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;CACvC;AAOD,eAAO,MAAM,kBAAkB,GAAI,QAAQ,cAAc,KAAG,MA6B5C,CAAC;AAKjB,eAAO,MAAM,iBAAiB,GAAI,QAAQ,cAAc,KAAG,MA+B1D,CAAC;AAIF,eAAO,MAAM,aAAa,GAAU,SAAS,MAAM,EAAE,cAAc,MAAM,EAAE,SAAS,MAAM,KAAG,OAAO,CAAC,IAAI,CAIxG,CAAC;AAGF,eAAO,MAAM,0BAA0B,GAAU,WAAW,MAAM,EAAE,WAAW,MAAM,EAAE,QAAQ,cAAc,KAAG,OAAO,CAAC,IAAI,CAG3H,CAAC;AAGF,eAAO,MAAM,cAAc,GAAU,MAAM;IACvC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACtD,KAAG,OAAO,CAAC,IAAI,CAYf,CAAC"}