@intentic/cli 1.325.0 → 1.327.0

package/README.md

@@ -12,17 +12,20 @@ flowchart LR
     engine --> infra["Hosts · Cloudflare<br/>Forgejo · Komodo"]
 ```
 
-- Four route groups in `src/app.ts`: `deploy` (the tool itself), `sandbox` (prints the canonical `docker run` for a sandbox), `tunnel host` (a host's own Cloudflare SSH tunnel) and `scaffold` (a pnpm + turbo monorepo and its apps).
+- Four route groups in `src/app.ts`: `deploy` (the tool itself), `sandbox` (prints the canonical `docker run` for a sandbox), `tunnel host` (a host's own Cloudflare SSH tunnel, made with the providers' own `findOrCreateTunnel` and `upsertCname` on the zone state-resolver's `selectZone` picks) and `scaffold` (a pnpm + turbo monorepo and its apps).
 - A workspace has separate git repos: `intent/` holds `deploy.config.ts`, `desired-state/` holds the resolved `desired-state.json`, `.env` and generated secrets. `deploy init` scaffolds them; every other command reads these default paths from cwd.
-- `deploy resolve` reaches the network only to discover the Cloudflare zone from the API token. `plan` and `apply` never re-resolve; they work from the baked artifact.
-- `deploy apply` takes a lock on every host, generates missing secrets, applies authored renames, runs the reconcile loop, then prunes what the previous artifact declared and this one does not. Deletions wait for `--yes`.
-- `deploy adopt` pushes both repos to the provisioned Forgejo and installs pipelines, so later pushes resolve and apply in CI with this CLI's own version.
+- `deploy resolve` reaches the network only to discover the Cloudflare zone from the API token. `plan` and `apply` never re-resolve; they work from the baked artifact. Resolve keeps the artifact's `owner` id, the intent's mark on everything it deploys, and mints one only when neither the artifact nor the baseline has it; the CI pipeline never mints (2026-10-05).
+- `deploy apply` takes a lock on every host, generates missing secrets, applies authored renames, runs the reconcile loop, then prunes what the baseline holds and this artifact does not, this intent's own orphans, and its leftovers on hosts a migration retired. Deletions wait for `--yes`. A heartbeat renews the lock while the run lasts and stops it if the lock is lost (2026-10-05).
+- The prune baseline, `.last-applied.json` beside the artifact (in CI, the `intentic-applied` tag's message), is a record, not a copy (2026-10-05). It advances with every apply, even while deletions wait for `--yes`, and keeps removed nodes in `pendingDeletion` until a delete succeeds, and retired hosts until one scans clean. A baseline that cannot be read stops the run before it changes anything. A missing one is a first apply only when nothing live carries this intent's owner stamp; otherwise it was lost, and `--first-apply` is the person's way through.
+- `deploy plan --check` is the drift check: it changes nothing and fails on anything apply would change or delete, and on unowned resources or a scan that could not look everywhere.
+- `deploy adopt` pushes both repos to the provisioned Forgejo, seeds the `intentic-applied` tag with the local baseline, and installs pipelines, so later pushes resolve and apply in CI with this CLI's own version. The apply pipeline also runs the drift check daily.
 
 ## Key files
 
 - [src/app.ts](src/app.ts) — the command tree and the one-line error format.
 - [src/resolve/resolve.ts](src/resolve/resolve.ts) — imports the config in place and discovers the Cloudflare zone.
 - [src/apply/apply.command.ts](src/apply/apply.command.ts) — lock, secrets, moves, reconcile loop, prune.
+- [src/apply/baseline.ts](src/apply/baseline.ts) — the prune baseline record, and telling a first apply from a lost baseline.
 - [src/lib/artifact.ts](src/lib/artifact.ts) — default paths, artifact read/write and `.env` loading.
 - [src/pipelines/adopt-pipelines.ts](src/pipelines/adopt-pipelines.ts) — the CI workflows and repo secrets `adopt` installs.
 

package/dist/adopt/adopt.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.command.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAmBlE,eAAO,MAAM,KAAK,iDAiHhB,CAAC"}
+{"version":3,"file":"adopt.command.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAqBlE,eAAO,MAAM,KAAK,iDAwHhB,CAAC"}

package/dist/adopt/adopt.command.js

@@ -1,14 +1,16 @@
-import { dirname, join } from "node:path";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { plural } from "@intentic/base/format";
-import { FORGEJO_HTTP_PORT, forgejoApi, overSsh, sshExecutor } from "@intentic/providers";
+import { FORGEJO_HTTP_PORT, forgejoApi, overSsh } from "@intentic/providers";
 import { secretDigest, writeSyncState } from "@intentic/scaffold";
 import { buildCommand } from "@stricli/core";
 import { loadConfig } from "../env.config.js";
-import { ARTIFACT_FILE, ARTIFACT_PATH, CONFIG_FILE, INTENT_DIR, loadEnvFile, readArtifact, TARGET_DIR } from "../lib/artifact.js";
+import { ARTIFACT_FILE, ARTIFACT_PATH, CONFIG_FILE, INTENT_DIR, LAST_APPLIED_FILE, loadEnvFile, readArtifact, TARGET_DIR } from "../lib/artifact.js";
+import { pinnedSshExecutor } from "../lib/known-hosts.js";
 import { createOutput, teeOutput } from "../lib/output.js";
 import { withRunLog } from "../lib/run-log.js";
 import { version } from "../lib/version.js";
-import { collectSecretValues, GIT_TOKEN_SECRET, GIT_USER_SECRET, setRepoSecrets, writeControlPlaneWorkflows, } from "../pipelines/adopt-pipelines.js";
+import { APPLIED_TAG, collectSecretValues, GIT_TOKEN_SECRET, GIT_USER_SECRET, setRepoSecrets, writeControlPlaneWorkflows, } from "../pipelines/adopt-pipelines.js";
 import { forgejoIdentity } from "../pipelines/control-plane-sync.js";
 import { createEventsFileSink } from "../lib/events-file.js";
 import { readGeneratedSecrets } from "../secrets/generated-secrets.js";
@@ -66,6 +68,7 @@ export const adopt = buildCommand({
         if (desiredStateSecrets["CLOUDFLARE_API_TOKEN"] !== undefined) {
             intentSecrets["CLOUDFLARE_API_TOKEN"] = desiredStateSecrets["CLOUDFLARE_API_TOKEN"];
         }
+        const baselineFile = resolve(targetDir, LAST_APPLIED_FILE);
         const run = async (baseUrl) => {
             const repos = await adoptRepos({
                 baseUrl,
@@ -74,7 +77,11 @@ export const adopt = buildCommand({
                 password,
                 repos: [
                     { dir: intentDir, name: INTENT_DIR },
-                    { dir: targetDir, name: TARGET_DIR },
+                    {
+                        dir: targetDir,
+                        name: TARGET_DIR,
+                        ...(existsSync(baselineFile) ? { seedTag: { name: APPLIED_TAG, messageFile: baselineFile } } : {}),
+                    },
                 ],
                 log: out.log,
             });
@@ -91,7 +98,7 @@ export const adopt = buildCommand({
             if (sshKey === undefined || sshKey === "") {
                 throw new Error(`host ssh key (${ssh.sshKeyRef.source} secret ${ssh.sshKeyRef.key}) is not available`);
             }
-            repos = await overSsh(sshExecutor, { address: ssh.address, user: ssh.user, sshKey, port: ssh.port ?? 22, via: ssh.via ?? "direct" }, FORGEJO_HTTP_PORT, run);
+            repos = await overSsh(pinnedSshExecutor(targetDir), { address: ssh.address, user: ssh.user, sshKey, port: ssh.port ?? 22, via: ssh.via ?? "direct" }, FORGEJO_HTTP_PORT, run);
         }
         const pushedAt = new Date().toISOString();
         await writeSyncState(targetDir, Object.fromEntries(Object.entries(desiredStateSecrets).map(([key, value]) => [key, { digest: secretDigest(value), pushedAt }])));

package/dist/adopt/adopt.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.command.js","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACH,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EAEf,cAAc,EACd,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAA0C;IACvE,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,OAAO,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oKAAoK;aAC9K;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAA8C;QAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9F,MAAM,GAAG,GACL,MAAM,CAAC,kBAAkB,KAAK,EAAE;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,GAAW,EAAsB,EAAE,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5I,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QACjG,CAAC;QAGD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAErF,MAAM,MAAM,GAAmB;YAC3B,UAAU,EAAE,OAAO;YACnB,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,UAAU;YACtB,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;YAC5D,kBAAkB,EAAE,GAAG,CAAC,GAAG;SAC9B,CAAC;QAEF,MAAM,0BAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAG/D,MAAM,aAAa,GAA2B,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;QACxG,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,aAAa,CAAC,sBAAsB,CAAC,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAmE,EAAE;YACnG,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;gBAC3B,OAAO;gBACP,aAAa,EAAE,WAAW,MAAM,EAAE;gBAClC,IAAI;gBACJ,QAAQ;gBACR,KAAK,EAAE;oBACH,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;oBACpC,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;iBACvC;gBACD,GAAG,EAAE,GAAG,CAAC,GAAG;aACf,CAAC,CAAC;YACH,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1H,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAChI,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QAGF,IAAI,KAA6D,CAAC;QAClE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAAC,CAAC;YAC3G,CAAC;YACD,KAAK,GAAG,MAAM,OAAO,CACjB,WAAW,EACX,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,EAChG,iBAAiB,EACjB,GAAG,CACN,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,cAAc,CAChB,SAAS,EACT,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAClI,CAAC;QACF,GAAG,CAAC,IAAI,CACJ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,OAAO,IAAI,IAAI,UAAU,EAAE,CAC7J,CAAC;QACF,GAAG,CAAC,MAAM,CAAC;YACP,KAAK;YACL,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;YACpD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}
+{"version":3,"file":"adopt.command.js","sourceRoot":"","sources":["../../src/adopt/adopt.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC7E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EACH,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EAEf,cAAc,EACd,0BAA0B,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,MAAM,CAAC,MAAM,KAAK,GAAG,YAAY,CAA0C;IACvE,IAAI,EAAE,EAAE,KAAK,EAAE,0EAA0E,EAAE;IAC3F,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,OAAO,EAAE;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,oKAAoK;aAC9K;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAA8C;QAC3E,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC9F,MAAM,GAAG,GACL,MAAM,CAAC,kBAAkB,KAAK,EAAE;YAC5B,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/G,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEpC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QACvD,WAAW,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;YAC1E,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;YAC5E,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACtD,OAAO;QACX,CAAC;QAED,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QAC5E,MAAM,eAAe,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;QAC9D,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,GAAW,EAAsB,EAAE,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5I,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,WAAW,GAAG,CAAC,GAAG,oBAAoB,CAAC,CAAC;QACjG,CAAC;QAGD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAErF,MAAM,MAAM,GAAmB;YAC3B,UAAU,EAAE,OAAO;YACnB,IAAI;YACJ,MAAM;YACN,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,aAAa;YAC3B,UAAU,EAAE,UAAU;YACtB,gBAAgB,EAAE,UAAU;YAC5B,eAAe,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;YAC5D,kBAAkB,EAAE,GAAG,CAAC,GAAG;SAC9B,CAAC;QAEF,MAAM,0BAA0B,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QAG/D,MAAM,aAAa,GAA2B,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,CAAC;QACxG,IAAI,mBAAmB,CAAC,sBAAsB,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,aAAa,CAAC,sBAAsB,CAAC,GAAG,mBAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxF,CAAC;QAGD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,iBAAiB,CAAC,CAAC;QAC3D,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAmE,EAAE;YACnG,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC;gBAC3B,OAAO;gBACP,aAAa,EAAE,WAAW,MAAM,EAAE;gBAClC,IAAI;gBACJ,QAAQ;gBACR,KAAK,EAAE;oBACH,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE;oBACpC;wBACI,GAAG,EAAE,SAAS;wBACd,IAAI,EAAE,UAAU;wBAChB,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACrG;iBACJ;gBACD,GAAG,EAAE,GAAG,CAAC,GAAG;aACf,CAAC,CAAC;YACH,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1H,MAAM,cAAc,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAChI,OAAO,KAAK,CAAC;QACjB,CAAC,CAAC;QAGF,IAAI,KAA6D,CAAC;QAClE,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC9B,KAAK,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACJ,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACpE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,iBAAiB,GAAG,CAAC,SAAS,CAAC,MAAM,WAAW,GAAG,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAAC,CAAC;YAC3G,CAAC;YAED,KAAK,GAAG,MAAM,OAAO,CACjB,iBAAiB,CAAC,SAAS,CAAC,EAC5B,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,IAAI,QAAQ,EAAE,EAChG,iBAAiB,EACjB,GAAG,CACN,CAAC;QACN,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1C,MAAM,cAAc,CAChB,SAAS,EACT,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAClI,CAAC;QACF,GAAG,CAAC,IAAI,CACJ,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,OAAO,IAAI,IAAI,UAAU,EAAE,CAC7J,CAAC;QACF,GAAG,CAAC,MAAM,CAAC;YACP,KAAK;YACL,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;YACpD,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE;SACnE,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}

package/dist/adopt/adopt.d.ts

@@ -1,8 +1,12 @@
 import type { ForgejoApi } from "@intentic/providers";
-import { type GitRunner } from "@intentic/scaffold";
+import { type GitRunner } from "@intentic/base/git";
 export interface AdoptRepo {
     readonly dir: string;
     readonly name: string;
+    readonly seedTag?: {
+        readonly name: string;
+        readonly messageFile: string;
+    };
 }
 export interface AdoptOptions {
     readonly baseUrl: string;

package/dist/adopt/adopt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;CAC5B;AAID,eAAO,MAAM,UAAU,YAAmB,YAAY,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAwBtH,CAAC"}
+{"version":3,"file":"adopt.d.ts","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAA4B,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE9E,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9E;AAED,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,CAAC;IACrC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,GAAG,CAAC,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;CAC5B;AAID,eAAO,MAAM,UAAU,YAAmB,YAAY,KAAG,OAAO,CAAC;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAAE,CAiDtH,CAAC"}

package/dist/adopt/adopt.js

@@ -1,12 +1,13 @@
+import { errorMessage } from "@intentic/base/errors";
 import { forgejoApi } from "@intentic/providers";
-import { defaultGit, gitCommitAll } from "@intentic/scaffold";
+import { defaultGit, gitCommitAll } from "@intentic/base/git";
 export const adoptRepos = async (options) => {
     const api = options.api ?? forgejoApi;
     const git = options.git ?? defaultGit;
     const { baseUrl, originBaseUrl, user, password, repos, log } = options;
     const email = `${user}@${new URL(originBaseUrl).host}`;
     const authHeader = `AUTHORIZATION: basic ${Buffer.from(`${user}:${password}`).toString("base64")}`;
-    return Promise.all(repos.map(async ({ dir, name }) => {
+    return Promise.all(repos.map(async ({ dir, name, seedTag }) => {
         const existing = await api.findRepo({ baseUrl, user, password, owner: user, name });
         if (existing === undefined) {
             await api.createRepo({ baseUrl, user, password, owner: user, ownerIsOrg: false, name, private: true, autoInit: false });
@@ -16,7 +17,31 @@ export const adoptRepos = async (options) => {
         const cloneUrl = `${originBaseUrl}/${user}/${name}.git`;
         const remotes = (await git(dir, ["remote"])).stdout.split("\n").map((line) => line.trim());
         await git(dir, remotes.includes("origin") ? ["remote", "set-url", "origin", cloneUrl] : ["remote", "add", "origin", cloneUrl]);
-        await git(dir, ["-c", `http.extraHeader=${authHeader}`, "push", `${baseUrl}/${user}/${name}.git`, "main"]);
+        const pushUrl = `${baseUrl}/${user}/${name}.git`;
+        if (seedTag !== undefined) {
+            try {
+                await git(dir, [
+                    "-c",
+                    `user.name=${user}`,
+                    "-c",
+                    `user.email=${email}`,
+                    "tag",
+                    "-f",
+                    "-a",
+                    "--cleanup=verbatim",
+                    "-F",
+                    seedTag.messageFile,
+                    seedTag.name,
+                    "HEAD",
+                ]);
+                await git(dir, ["-c", `http.extraHeader=${authHeader}`, "push", pushUrl, `refs/tags/${seedTag.name}`]);
+                log(`seeded ${user}/${name}'s ${seedTag.name} tag with the local prune baseline`);
+            }
+            catch (error) {
+                log(`kept ${user}/${name}'s ${seedTag.name} tag as it is (${errorMessage(error)})`);
+            }
+        }
+        await git(dir, ["-c", `http.extraHeader=${authHeader}`, "push", pushUrl, "main"]);
         log(`pushed ${dir} → ${cloneUrl}`);
         return { name, cloneUrl };
     }));

package/dist/adopt/adopt.js.map

@@ -1 +1 @@
-{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AAuB9E,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAqB,EAAmE,EAAE;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEnG,OAAO,OAAO,CAAC,GAAG,CACd,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxH,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,GAAG,aAAa,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAE/H,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB,UAAU,EAAE,EAAE,MAAM,EAAE,GAAG,OAAO,IAAI,IAAI,IAAI,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC3G,GAAG,CAAC,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC,CAAC,CACL,CAAC;AACN,CAAC,CAAC"}
+{"version":3,"file":"adopt.js","sourceRoot":"","sources":["../../src/adopt/adopt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAkB,MAAM,oBAAoB,CAAC;AA0B9E,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,OAAqB,EAAmE,EAAE;IACvH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC;IACtC,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC;IACvE,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,MAAM,UAAU,GAAG,wBAAwB,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;IAEnG,OAAO,OAAO,CAAC,GAAG,CACd,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;YACxH,GAAG,CAAC,WAAW,IAAI,IAAI,IAAI,aAAa,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,YAAY,CAAC,GAAG,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACtE,MAAM,QAAQ,GAAG,GAAG,aAAa,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC;QACxD,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,MAAM,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/H,MAAM,OAAO,GAAG,GAAG,OAAO,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC;QAGjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,GAAG,CAAC,GAAG,EAAE;oBACX,IAAI;oBACJ,aAAa,IAAI,EAAE;oBACnB,IAAI;oBACJ,cAAc,KAAK,EAAE;oBACrB,KAAK;oBACL,IAAI;oBACJ,IAAI;oBACJ,oBAAoB;oBACpB,IAAI;oBACJ,OAAO,CAAC,WAAW;oBACnB,OAAO,CAAC,IAAI;oBACZ,MAAM;iBACT,CAAC,CAAC;gBACH,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBACvG,GAAG,CAAC,UAAU,IAAI,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,oCAAoC,CAAC,CAAC;YACtF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,MAAM,OAAO,CAAC,IAAI,kBAAkB,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxF,CAAC;QACL,CAAC;QAED,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,oBAAoB,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;QAClF,GAAG,CAAC,UAAU,GAAG,MAAM,QAAQ,EAAE,CAAC,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC9B,CAAC,CAAC,CACL,CAAC;AACN,CAAC,CAAC"}

package/dist/apply/apply-lock.d.ts

@@ -3,10 +3,22 @@ export interface ApplyLock {
     readonly verify: () => Promise<void>;
     readonly renew: () => Promise<void>;
     readonly release: () => Promise<void>;
+    readonly ttlSeconds: number;
+}
+export declare class LockLostError extends Error {
+    constructor(host: string);
 }
 export declare const acquireApplyLock: (executor: SshExecutor, targets: readonly SshTarget[], options?: {
     readonly ttlSeconds?: number;
     readonly holder?: string;
     readonly log?: (message: string) => void;
 }) => Promise<ApplyLock>;
+export interface LockHeartbeat {
+    readonly stop: () => void;
+}
+export declare const startLockHeartbeat: (lock: ApplyLock, options: {
+    readonly onLost: (error: Error) => void;
+    readonly intervalMs?: number;
+    readonly log?: (message: string) => void;
+}) => LockHeartbeat;
 //# sourceMappingURL=apply-lock.d.ts.map

package/dist/apply/apply-lock.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply-lock.d.ts","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAa,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAU7E,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAErC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAmED,eAAO,MAAM,gBAAgB,aACf,WAAW,WACZ,SAAS,SAAS,EAAE,YACpB;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,KAC9G,OAAO,CAAC,SAAS,CA4DnB,CAAC"}
+{"version":3,"file":"apply-lock.d.ts","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAa,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAU7E,MAAM,WAAW,SAAS;IAEtB,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAGrC,QAAQ,CAAC,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpC,QAAQ,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC/B;AAGD,qBAAa,aAAc,SAAQ,KAAK;IACpC,YAAY,IAAI,EAAE,MAAM,EAGvB;CACJ;AAmED,eAAO,MAAM,gBAAgB,aACf,WAAW,WACZ,SAAS,SAAS,EAAE,YACpB;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,KAC9G,OAAO,CAAC,SAAS,CAgEnB,CAAC;AAEF,MAAM,WAAW,aAAa;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC;CAC7B;AAMD,eAAO,MAAM,kBAAkB,SACrB,SAAS,WACN;IACL,QAAQ,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C,KACF,aAsCF,CAAC"}

package/dist/apply/apply-lock.js

@@ -4,6 +4,12 @@ import { HOST_STATE_ROOT } from "@intentic/constants";
 import { shellQuote } from "@intentic/sandbox-run/quote";
 const LOCK_DIR = `${HOST_STATE_ROOT}/apply.lock.d`;
 const DEFAULT_TTL_SECONDS = 30 * 60;
+export class LockLostError extends Error {
+    constructor(host) {
+        super(`apply lock on ${host} was taken over by another run`);
+        this.name = "LockLostError";
+    }
+}
 const lockKey = (target) => `${target.address}:${target.port}`;
 const orderedHosts = (targets) => {
     const byKey = new Map();
@@ -95,10 +101,53 @@ export const acquireApplyLock = async (executor, targets, options = {}) => {
         },
         renew: async () => {
             for (const target of held) {
-                await run(executor, target, renewScript(holder, nonce, ttl));
+                const outcome = (await run(executor, target, renewScript(holder, nonce, ttl))).stdout.trim();
+                if (!outcome.startsWith("OK")) {
+                    throw new LockLostError(lockKey(target));
+                }
             }
         },
         release: releaseAll,
+        ttlSeconds: ttl,
+    };
+};
+export const startLockHeartbeat = (lock, options) => {
+    const log = options.log ?? (() => { });
+    const intervalMs = options.intervalMs ?? (lock.ttlSeconds * 1000) / 3;
+    let failures = 0;
+    let busy = false;
+    let stopped = false;
+    const timer = setInterval(() => {
+        if (busy || stopped) {
+            return;
+        }
+        busy = true;
+        void lock
+            .renew()
+            .then(() => {
+            failures = 0;
+        })
+            .catch((error) => {
+            failures += 1;
+            const lost = error instanceof LockLostError;
+            if (lost || failures >= 2) {
+                stopped = true;
+                clearInterval(timer);
+                options.onLost(lost ? error : new Error(`could not renew the apply lock twice in a row: ${String(error)}`, { cause: error }));
+                return;
+            }
+            log(`apply-lock: renewal failed, retrying at the next beat: ${String(error)}`);
+        })
+            .finally(() => {
+            busy = false;
+        });
+    }, intervalMs);
+    timer.unref();
+    return {
+        stop: () => {
+            stopped = true;
+            clearInterval(timer);
+        },
     };
 };
 //# sourceMappingURL=apply-lock.js.map

package/dist/apply/apply-lock.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply-lock.js","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAKzD,MAAM,QAAQ,GAAG,GAAG,eAAe,eAAe,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAWpC,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAIlF,MAAM,YAAY,GAAG,CAAC,OAA6B,EAAe,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AAItG,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CAAC,cAAc,EAAE,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;AAIxG,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACzE,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC;;OAE7B,QAAQ;;;4DAG6C,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,uBAAuB,GAAG;;;;;;;;yBAQpG,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACxD,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,oDAAoD,QAAQ;aAClF,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACvE,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;gBAGlC,UAAU,CAAC,KAAK,CAAC,oEAAoE,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,uBAAuB,GAAG,oDAAoD,CAAC;AAE3N,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACzD,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;gBAGpC,UAAU,CAAC,KAAK,CAAC,6FAA6F,CAAC;AAE/H,MAAM,GAAG,GAAG,KAAK,EAAE,QAAqB,EAAE,MAAiB,EAAE,OAAe,EAAsB,EAAE;IAChG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACjC,QAAqB,EACrB,OAA6B,EAC7B,OAAO,GAAyG,EAAE,EAChG,EAAE;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QACzC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,iCAAiC,OAAO,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,kCAAkC,OAAO,CAAC,MAAM,CAAC,ySAAyS,CAC7V,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,KAAK,CACX,gDAAgD,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,wEAAwE,CAClL,CAAC;IACN,CAAC;IAED,OAAO;QACH,MAAM,EAAE,KAAK,IAAI,EAAE;YACf,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACX,iBAAiB,OAAO,CAAC,MAAM,CAAC,sFAAsF,CACzH,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACd,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YACjE,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU;KACtB,CAAC;AACN,CAAC,CAAC"}
+{"version":3,"file":"apply-lock.js","sourceRoot":"","sources":["../../src/apply/apply-lock.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAKzD,MAAM,QAAQ,GAAG,GAAG,eAAe,eAAe,CAAC;AAEnD,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,CAAC;AAepC,MAAM,OAAO,aAAc,SAAQ,KAAK;IACpC,YAAY,IAAY;QACpB,KAAK,CAAC,iBAAiB,IAAI,gCAAgC,CAAC,CAAC;QAC7D,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAChC,CAAC;CACJ;AAED,MAAM,OAAO,GAAG,CAAC,MAAiB,EAAU,EAAE,CAAC,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;AAIlF,MAAM,YAAY,GAAG,CAAC,OAA6B,EAAe,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAC;IAC3C,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxF,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,GAAW,EAAE,CAAC,GAAG,QAAQ,EAAE,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC;AAItG,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CAAC,cAAc,EAAE,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC;AAIxG,MAAM,aAAa,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACzE,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC;;OAE7B,QAAQ;;;4DAG6C,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,uBAAuB,GAAG;;;;;;;;yBAQpG,CAAC;AAE1B,MAAM,YAAY,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACxD,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,oDAAoD,QAAQ;aAClF,UAAU,CAAC,KAAK,CAAC,mCAAmC,CAAC;AAElE,MAAM,WAAW,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,GAAW,EAAU,EAAE,CACvE,GAAG,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;gBAGlC,UAAU,CAAC,KAAK,CAAC,oEAAoE,UAAU,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,uBAAuB,GAAG,oDAAoD,CAAC;AAE3N,MAAM,aAAa,GAAG,CAAC,KAAa,EAAE,GAAW,EAAU,EAAE,CACzD,GAAG,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,CAAC,QAAQ,QAAQ;;;gBAGpC,UAAU,CAAC,KAAK,CAAC,6FAA6F,CAAC;AAE/H,MAAM,GAAG,GAAG,KAAK,EAAE,QAAqB,EAAE,MAAiB,EAAE,OAAe,EAAsB,EAAE;IAChG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC;QACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,EACjC,QAAqB,EACrB,OAA6B,EAC7B,OAAO,GAAyG,EAAE,EAChG,EAAE;IACpB,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,EAAE,CAAC;IACjD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAgB,EAAE,CAAC;IAE7B,MAAM,UAAU,GAAG,KAAK,IAAmB,EAAE;QACzC,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;YACxB,IAAI,CAAC;gBACD,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,GAAG,CAAC,iCAAiC,OAAO,CAAC,MAAM,CAAC,8BAA8B,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACvG,CAAC;QACL,CAAC;IACL,CAAC,CAAC;IAEF,KAAK,MAAM,MAAM,IAAI,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QACzC,IAAI,MAAiB,CAAC;QACtB,IAAI,CAAC;YACD,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,eAAe,OAAO,CAAC,MAAM,CAAC,yCAAyC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5F,SAAS;QACb,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClB,SAAS;QACb,CAAC;QACD,MAAM,UAAU,EAAE,CAAC;QACnB,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACX,kCAAkC,OAAO,CAAC,MAAM,CAAC,ySAAyS,CAC7V,CAAC;QACN,CAAC;QACD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5C,MAAM,IAAI,KAAK,CACX,gDAAgD,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,wEAAwE,CAClL,CAAC;IACN,CAAC;IAED,OAAO;QACH,MAAM,EAAE,KAAK,IAAI,EAAE;YACf,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;gBACrE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzC,MAAM,IAAI,KAAK,CACX,iBAAiB,OAAO,CAAC,MAAM,CAAC,sFAAsF,CACzH,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC;QACD,KAAK,EAAE,KAAK,IAAI,EAAE;YACd,KAAK,MAAM,MAAM,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,OAAO,GAAG,CAAC,MAAM,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC7F,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC5B,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC7C,CAAC;YACL,CAAC;QACL,CAAC;QACD,OAAO,EAAE,UAAU;QACnB,UAAU,EAAE,GAAG;KAClB,CAAC;AACN,CAAC,CAAC;AAUF,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAC9B,IAAe,EACf,OAIC,EACY,EAAE;IACf,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;QAC3B,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC;YAClB,OAAO;QACX,CAAC;QACD,IAAI,GAAG,IAAI,CAAC;QACZ,KAAK,IAAI;aACJ,KAAK,EAAE;aACP,IAAI,CAAC,GAAG,EAAE;YACP,QAAQ,GAAG,CAAC,CAAC;QACjB,CAAC,CAAC;aACD,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YACtB,QAAQ,IAAI,CAAC,CAAC;YACd,MAAM,IAAI,GAAG,KAAK,YAAY,aAAa,CAAC;YAC5C,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBACxB,OAAO,GAAG,IAAI,CAAC;gBACf,aAAa,CAAC,KAAK,CAAC,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,kDAAkD,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC9H,OAAO;YACX,CAAC;YACD,GAAG,CAAC,0DAA0D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACV,IAAI,GAAG,KAAK,CAAC;QACjB,CAAC,CAAC,CAAC;IACX,CAAC,EAAE,UAAU,CAAC,CAAC;IACf,KAAK,CAAC,KAAK,EAAE,CAAC;IACd,OAAO;QACH,IAAI,EAAE,GAAG,EAAE;YACP,OAAO,GAAG,IAAI,CAAC;YACf,aAAa,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;KACJ,CAAC;AACN,CAAC,CAAC"}

package/dist/apply/apply.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apply.command.d.ts","sourceRoot":"","sources":["../../src/apply/apply.command.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAgB,KAAK,cAAc,EAAgB,MAAM,eAAe,CAAC;AA0BhF,eAAO,MAAM,KAAK,iDAuNhB,CAAC"}
+{"version":3,"file":"apply.command.d.ts","sourceRoot":"","sources":["../../src/apply/apply.command.ts"],"names":[],"mappings":"AAsBA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AA8ClE,eAAO,MAAM,KAAK,iDAoThB,CAAC"}

package/dist/apply/apply.command.js

@@ -1,26 +1,32 @@
-import { existsSync } from "node:fs";
-import { readFile, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { plural } from "@intentic/base/format";
-import { applyMoves, collectOrphans, createStore, prune, pruneOrphans, ReadinessTimeoutError, reconcile, resolveInputs, rewriteGraphForMoves, } from "@intentic/engine";
-import { connectWithRetry, createProviders, createSshExecutor, createSshProbe, hostTarget, readinessDiagnostics } from "@intentic/providers";
-import { buildCommand, numberParser } from "@stricli/core";
+import { applyMoves, collectOrphans, createStore, ReadinessTimeoutError, reconcile, resolveInputs, rewriteGraphForMoves, } from "@intentic/engine";
+import { connectWithRetry, createProviders, createSshProbe, hostTarget, readinessDiagnostics, } from "@intentic/providers";
+import { buildCommand } from "@stricli/core";
 import { collectSecretUsage, subgraph } from "@intentic/graph";
 import { loadConfig } from "../env.config.js";
 import { ACCESS_FILE, ARTIFACT_PATH, LAST_APPLIED_FILE, loadEnvFile, readArtifact, STATUS_FILE, writeStatus } from "../lib/artifact.js";
-import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { countAtLeast } from "../lib/flags.js";
+import { pinnedSshExecutor } from "../lib/known-hosts.js";
 import { createOutput, createRedactor, teeOutput } from "../lib/output.js";
 import { withRunLog } from "../lib/run-log.js";
-import { resourceTable } from "../lib/tables.js";
-import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
+import { pendingBlock, resourceTable, retiredBlock, scanGapBlock, unownedBlock } from "../lib/tables.js";
+import { ensureGeneratedSecrets, loadStoredSecrets } from "../secrets/generated-secrets.js";
 import { generatedSecretStore } from "../secrets/secret-store.js";
 import { collectSecrets } from "../secrets/secrets.js";
 import { collectAccess, formatAccessSummary, writeAccessFile } from "./access.js";
 import { createEventsFileSink } from "../lib/events-file.js";
-import { acquireApplyLock } from "./apply-lock.js";
+import { acquireApplyLock, startLockHeartbeat } from "./apply-lock.js";
+import { checkFirstApply, loadBaseline, mergeRetiredHosts, nextBaseline, pruneBase, removedNodes, writeBaseline, } from "./baseline.js";
 import { detectHostMoves, migrateHosts } from "./migrate.js";
+import { runPrunePhase } from "./prune-phase.js";
+import { retiredTarget, scanRetiredHosts } from "./retired-hosts.js";
 const DEFAULT_MAX_ITERATIONS = 5;
+const trackedGraph = (base, retired) => ({
+    version: 1,
+    resources: { ...base?.resources, ...Object.fromEntries(retired.map((host) => [`retired:${host.id}@${host.address}`, host.node])) },
+});
 export const apply = buildCommand({
     docs: { brief: "Execute the desired-state artifact until state reads true" },
     parameters: {
@@ -28,7 +34,7 @@ export const apply = buildCommand({
             artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` },
             maxIterations: {
                 kind: "parsed",
-                parse: numberParser,
+                parse: countAtLeast(1),
                 optional: true,
                 brief: `Max reconcile iterations (default ${DEFAULT_MAX_ITERATIONS})`,
             },
@@ -36,11 +42,11 @@ export const apply = buildCommand({
                 kind: "parsed",
                 parse: String,
                 optional: true,
-                brief: "Path to the last successfully-applied artifact; resources absent from the new one are pruned after convergence",
+                brief: `Path to the prune baseline (default: ${LAST_APPLIED_FILE} beside the artifact); resources it holds and the new artifact lacks are pruned after convergence`,
             },
             yes: {
                 kind: "boolean",
-                brief: "Confirm deletions: without it, pending prunes are listed and left in place (converge still runs)",
+                brief: "Confirm deletions: without it, pending prunes are listed and kept in the baseline, left in place (converge still runs)",
             },
             target: {
                 kind: "parsed",
@@ -48,6 +54,10 @@ export const apply = buildCommand({
                 optional: true,
                 brief: "Comma-separated resource ids: reconcile only these and their dependencies (prune and orphan scan are skipped)",
             },
+            firstApply: {
+                kind: "boolean",
+                brief: "Start a new prune baseline when none can be read, even though resources of this intent are live (what a lost baseline tracked is then removed by hand)",
+            },
         },
     },
     async func(flags) {
@@ -65,10 +75,20 @@ export const apply = buildCommand({
             .map((id) => id.trim())
             .filter((id) => id !== "");
         const graph = targetIds === undefined ? full : subgraph(full, targetIds);
-        const ssh = createSshExecutor(createKnownHostsStore(dir));
-        const previousPath = flags.previous ?? join(dir, LAST_APPLIED_FILE);
-        const previous = existsSync(previousPath) ? await readArtifact(previousPath) : undefined;
-        const hostMoves = previous !== undefined ? detectHostMoves(previous, graph) : [];
+        const ssh = pinnedSshExecutor(dir);
+        const baselinePath = flags.previous ?? join(dir, LAST_APPLIED_FILE);
+        const lastApplied = join(dir, LAST_APPLIED_FILE);
+        const previous = await loadBaseline(baselinePath, { explicit: flags.previous !== undefined, firstApply: flags.firstApply, note: out.text });
+        const owner = full.owner ?? previous?.owner;
+        if (full.owner !== undefined && previous?.owner !== undefined && full.owner !== previous.owner) {
+            throw new Error(`the artifact's owner id (${full.owner}) is not the one this intent was applied with (${previous.owner}): every resource it stamped would read as another intent's. Put "owner": "${previous.owner}" back in ${artifact} (resolve keeps whatever is there).`);
+        }
+        if (full.owner === undefined) {
+            out.text("This artifact carries no owner id (it was resolved before owner stamps): nothing is stamped with an owner and no orphan is pruned. Re-run `intentic deploy resolve` to mint one.");
+        }
+        const hostMoves = previous !== undefined ? detectHostMoves({ version: 1, resources: previous.resources }, graph) : [];
+        const sinceUtcDay = new Date().toISOString().slice(0, 10);
+        const retiredHosts = mergeRetiredHosts(previous?.retiredHosts ?? [], hostMoves.map((move) => ({ id: move.id, address: move.oldAddress, node: move.oldNode, since: sinceUtcDay })), full);
         const targets = Object.values(graph.resources)
             .filter((node) => node.type === "host")
             .map((node) => hostTarget(resolveInputs(node.inputs, createStore(), process.env, { lenient: false })));
@@ -88,7 +108,18 @@ export const apply = buildCommand({
             await session.dispose();
         }));
         const oldMoveTargets = hostMoves.map((move) => hostTarget(resolveInputs(move.oldNode.inputs, createStore(), process.env, { lenient: false })));
-        const lock = await acquireApplyLock(ssh, [...targets, ...oldMoveTargets], { log: out.log });
+        const retiredTargets = retiredHosts
+            .map((host) => retiredTarget(host, process.env))
+            .filter((target) => typeof target !== "string");
+        const lock = await acquireApplyLock(ssh, [...targets, ...oldMoveTargets, ...retiredTargets], { log: out.log });
+        const stop = new AbortController();
+        const heartbeat = startLockHeartbeat(lock, {
+            log: out.log,
+            onLost: (error) => {
+                out.log(`apply-lock: ${error.message}; stopping before the next change`);
+                stop.abort(error);
+            },
+        });
         const onSignal = () => {
             void Promise.allSettled([lock.release(), ssh.dispose?.()]).finally(() => process.exit(130));
         };
@@ -97,20 +128,43 @@ export const apply = buildCommand({
         process.once("SIGHUP", onSignal);
         const signals = process;
         try {
-            await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, true, out.log), collectSecrets(graph).generated, process.env);
-            redactor.add(collectSecretUsage(graph).map((usage) => process.env[usage.key]));
-            if (hostMoves.length > 0) {
-                await migrateHosts(hostMoves, { next: graph, ssh, env: process.env, tmpDir: tmpdir(), log: out.log });
-            }
-            const movedApplied = await applyMoves(graph, {
+            const engine = () => ({
                 providers: createProviders({ ssh }),
                 log: out.log,
                 onEvent: out.onEvent,
                 env: process.env,
+                signal: stop.signal,
+                ...(owner !== undefined ? { owner } : {}),
             });
+            const store = generatedSecretStore(graph, dir, ssh, true, out.log);
+            await ensureGeneratedSecrets(store, collectSecrets(graph).generated, process.env);
+            const tracked = trackedGraph(previous !== undefined ? pruneBase(previous) : undefined, retiredHosts);
+            const current = new Set(collectSecrets(graph).generated);
+            await loadStoredSecrets(store, collectSecrets(tracked).generated.filter((key) => !current.has(key)), process.env, out.log);
+            redactor.add([...collectSecretUsage(graph), ...collectSecretUsage(tracked)].map((usage) => process.env[usage.key]));
+            if (previous === undefined && targetIds === undefined) {
+                const line = await checkFirstApply({
+                    path: baselinePath,
+                    owner,
+                    firstApply: flags.firstApply,
+                    scan: () => collectOrphans(graph, { ...engine(), onEvent: () => { }, log: () => { } }),
+                });
+                out.text(line);
+            }
+            if (hostMoves.length > 0) {
+                stop.signal.throwIfAborted();
+                await migrateHosts(hostMoves, { next: graph, ssh, env: process.env, tmpDir: tmpdir(), log: out.log });
+            }
+            const movedApplied = await applyMoves(graph, engine());
+            const base = previous !== undefined ? rewriteGraphForMoves(pruneBase(previous), movedApplied) : undefined;
+            if (targetIds === undefined) {
+                await writeBaseline(lastApplied, nextBaseline({ graph, owner, pending: base === undefined ? [] : removedNodes(base, graph), retiredHosts }));
+            }
             let result;
             try {
-                result = await reconcile(graph, { providers: createProviders({ ssh }), log: out.log, onEvent: out.onEvent, ...(probe !== undefined ? { probe } : {}) }, { maxIterations: flags.maxIterations ?? DEFAULT_MAX_ITERATIONS });
+                result = await reconcile(graph, { ...engine(), ...(probe !== undefined ? { probe } : {}) }, {
+                    maxIterations: flags.maxIterations ?? DEFAULT_MAX_ITERATIONS,
+                });
             }
             catch (error) {
                 if (error instanceof ReadinessTimeoutError && targets.length > 0) {
@@ -125,41 +179,63 @@ export const apply = buildCommand({
                 steps: result.outcome.steps,
                 access,
             });
+            let report = {};
             let pruned = { deleted: [], skipped: [] };
             if (targetIds !== undefined) {
                 out.text("A targeted apply reconciles only the named resources, so prune and the orphan scan were skipped.");
             }
             else {
-                const pruneConfig = { providers: createProviders({ ssh }), log: out.log, onEvent: out.onEvent, env: process.env };
-                const baseline = previous !== undefined ? rewriteGraphForMoves(previous, movedApplied) : undefined;
-                const removed = baseline === undefined ? [] : Object.values(baseline.resources).filter((node) => graph.resources[node.id] === undefined);
-                const orphans = await collectOrphans(graph, pruneConfig);
-                const pending = [
-                    ...removed.filter((node) => node.inputs["protect"] !== true),
-                    ...orphans.filter((orphan) => orphan.protected !== true),
-                ];
-                if (pending.length > 0 && !flags.yes) {
+                const retired = await scanRetiredHosts(retiredHosts, { ssh, env: process.env, owner, providers: createProviders({ ssh }) });
+                const phase = await runPrunePhase({
+                    graph,
+                    base,
+                    owner,
+                    retired,
+                    yes: flags.yes,
+                    config: engine(),
+                    beforeDelete: async () => {
+                        await lock.renew();
+                        await lock.verify();
+                    },
+                });
+                pruned = phase.pruned;
+                const retiredReports = retired.map((scan) => ({
+                    id: scan.host.id,
+                    address: scan.host.address,
+                    leftovers: scan.leftovers.map(({ id, type }) => ({ id, type })),
+                    unowned: scan.unowned,
+                    ...(scan.error !== undefined ? { error: scan.error } : {}),
+                }));
+                for (const line of [...unownedBlock(phase.scan.unowned), ...retiredBlock(retiredReports), ...scanGapBlock(phase.scan.skipped)]) {
+                    out.text(line);
+                }
+                if (phase.scan.foreign > 0) {
+                    out.text(`${plural(phase.scan.foreign, "stamped resource")} on shared hosts or zones belong to other intents; left alone.`);
+                }
+                if (phase.pending.length > 0) {
                     out.text("");
-                    for (const line of resourceTable("delete", pending)) {
+                    for (const line of resourceTable("delete", phase.pending)) {
                         out.text(line);
                     }
-                    out.text(`${plural(pending.length, "deletion")} pending, nothing was deleted. Re-run \`intentic deploy apply --yes\` to prune.`);
+                    out.text(`${plural(phase.pending.length, "deletion")} pending, nothing was deleted; the baseline keeps them. Re-run \`intentic deploy apply --yes\` to prune.`);
                 }
-                else {
-                    if (pending.length > 0) {
-                        await lock.renew();
-                        await lock.verify();
-                    }
-                    if (baseline !== undefined) {
-                        pruned = await prune(baseline, graph, pruneConfig);
-                    }
-                    const orphaned = await pruneOrphans(orphans, pruneConfig);
-                    pruned = { deleted: [...pruned.deleted, ...orphaned.deleted], skipped: [...pruned.skipped, ...orphaned.skipped] };
-                    if (pruned.deleted.length > 0 || pruned.skipped.length > 0) {
-                        out.text(`pruned ${plural(pruned.deleted.length, "resource")}${pruned.skipped.length > 0 ? `, ${pruned.skipped.length} left in place` : ""}`);
+                else if (phase.pruned.deleted.length > 0 || phase.pruned.skipped.length > 0) {
+                    out.text(`pruned ${plural(phase.pruned.deleted.length, "resource")}${phase.pruned.skipped.length > 0 ? `, ${phase.pruned.skipped.length} left in place` : ""}`);
+                }
+                const stillPending = Object.values(phase.baseline.pendingDeletion ?? {});
+                if (phase.pending.length === 0) {
+                    for (const line of pendingBlock(stillPending)) {
+                        out.text(line);
                     }
-                    await writeFile(join(dir, LAST_APPLIED_FILE), await readFile(artifact, "utf8"));
                 }
+                stop.signal.throwIfAborted();
+                await writeBaseline(lastApplied, phase.baseline);
+                report = {
+                    unowned: phase.scan.unowned,
+                    pendingDeletion: phase.pending.length > 0 ? phase.pending : stillPending.map(({ id, type }) => ({ id, type })),
+                    retiredHosts: retiredReports,
+                    scanSkipped: phase.scan.skipped,
+                };
             }
             out.text(`${result.converged ? "converged" : "did not converge"} in ${plural(result.iterations, "iteration")}`);
             if (access.length > 0) {
@@ -173,6 +249,7 @@ export const apply = buildCommand({
                 outputs: result.outcome.outputs,
                 pruned,
                 access,
+                ...report,
             });
             const reconcileWebhook = result.outcome.outputs["discord"]?.["reconcileWebhook"];
             if (typeof reconcileWebhook === "string" && reconcileWebhook !== "") {
@@ -198,6 +275,7 @@ export const apply = buildCommand({
             }
         }
         finally {
+            heartbeat.stop();
             signals.removeListener("SIGINT", onSignal);
             signals.removeListener("SIGTERM", onSignal);
             signals.removeListener("SIGHUP", onSignal);