@intentic/cli 1.326.0 → 1.327.0

package/dist/plan/plan.command.js

@@ -1,21 +1,40 @@
-import { dirname } from "node:path";
-import { collectOrphans, plan } from "@intentic/engine";
+import { dirname, join } from "node:path";
+import { errorMessage } from "@intentic/base/errors";
+import { plural } from "@intentic/base/format";
+import { collectOrphans, plan, rewriteGraphForMoves } from "@intentic/engine";
 import { collectSecretUsage, subgraph } from "@intentic/graph";
-import { createProviders, createSshExecutor } from "@intentic/providers";
+import { createProviders } from "@intentic/providers";
 import { buildCommand } from "@stricli/core";
+import { pruneBase, readBaseline, removedNodes } from "../apply/baseline.js";
+import { scanRetiredHosts } from "../apply/retired-hosts.js";
 import { loadConfig } from "../env.config.js";
-import { ARTIFACT_PATH, loadEnvFile, readArtifact } from "../lib/artifact.js";
+import { ARTIFACT_PATH, LAST_APPLIED_FILE, loadEnvFile, readArtifact } from "../lib/artifact.js";
 import { createEventsFileSink } from "../lib/events-file.js";
-import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { pinnedSshExecutor } from "../lib/known-hosts.js";
 import { createOutput, createRedactor, teeOutput } from "../lib/output.js";
 import { withRunLog } from "../lib/run-log.js";
-import { planSummary, planTable } from "../lib/tables.js";
+import { pendingBlock, planSummary, planTable, retiredBlock, scanGapBlock, unownedBlock } from "../lib/tables.js";
 import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
 import { generatedSecretStore } from "../secrets/secret-store.js";
 import { collectSecrets } from "../secrets/secrets.js";
 const PLAN_DEADLINE_MS = 5 * 60_000;
+export const driftReasons = (findings) => {
+    const changes = findings.steps.filter((step) => step.action !== "noop").length;
+    const leftovers = findings.retired.reduce((sum, host) => sum + host.leftovers.length + host.unowned.length, 0);
+    const unscanned = findings.retired.filter((host) => host.error !== undefined).length;
+    return [
+        ...(changes > 0 ? [`${plural(changes, "resource")} to create or update`] : []),
+        ...(findings.orphans.length > 0 ? [plural(findings.orphans.length, "orphan")] : []),
+        ...(findings.unowned.length > 0 ? [`${plural(findings.unowned.length, "unowned resource")}`] : []),
+        ...(findings.pending.length > 0 ? [`${plural(findings.pending.length, "pending deletion")}`] : []),
+        ...(leftovers > 0 ? [`${plural(leftovers, "leftover")} on retired hosts`] : []),
+        ...(unscanned > 0 ? [`${plural(unscanned, "retired host")} not scanned`] : []),
+        ...(findings.scanSkipped.length > 0 ? [`the orphan scan missed ${plural(findings.scanSkipped.length, "source")}`] : []),
+        ...(findings.baselineError !== undefined ? ["the prune baseline cannot be read"] : []),
+    ];
+};
 export const planCommand = buildCommand({
-    docs: { brief: "Show what applying the artifact would create/update (read-only)" },
+    docs: { brief: "Show what applying the artifact would create/update/delete (read-only)" },
     parameters: {
         flags: {
             artifact: { kind: "parsed", parse: String, optional: true, brief: `Path to the artifact (default: ${ARTIFACT_PATH})` },
@@ -25,6 +44,16 @@ export const planCommand = buildCommand({
                 optional: true,
                 brief: "Comma-separated resource ids: plan only these and their dependencies (skips the orphan scan)",
             },
+            previous: {
+                kind: "parsed",
+                parse: String,
+                optional: true,
+                brief: `Path to the prune baseline (default: ${LAST_APPLIED_FILE} beside the artifact), for the deletions it holds`,
+            },
+            check: {
+                kind: "boolean",
+                brief: "Drift check: exit non-zero when anything would change or be deleted, or needs a person (the scheduled CI job)",
+            },
         },
     },
     async func(flags) {
@@ -42,7 +71,20 @@ export const planCommand = buildCommand({
             .map((id) => id.trim())
             .filter((id) => id !== "");
         const graph = targets === undefined ? full : subgraph(full, targets);
-        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        const ssh = pinnedSshExecutor(dir);
+        const baselinePath = flags.previous ?? join(dir, LAST_APPLIED_FILE);
+        let previous;
+        let baselineError;
+        try {
+            previous = await readBaseline(baselinePath);
+            if (previous === undefined && flags.previous !== undefined) {
+                baselineError = `no prune baseline at ${baselinePath}`;
+            }
+        }
+        catch (error) {
+            baselineError = errorMessage(error);
+        }
+        const owner = full.owner ?? previous?.owner;
         let lastActivity = "loading generated secrets";
         const onEvent = (event) => {
             if (event.kind === "node" && event.state === "start") {
@@ -59,23 +101,63 @@ export const planCommand = buildCommand({
         const work = async () => {
             await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, false, log), collectSecrets(graph).generated, process.env);
             redactor.add(collectSecretUsage(graph).map((usage) => process.env[usage.key]));
-            const engineConfig = { providers: createProviders({ ssh }), log, onEvent };
+            const engineConfig = { providers: createProviders({ ssh }), log, onEvent, ...(owner !== undefined ? { owner } : {}) };
             const outcome = await plan(graph, engineConfig);
             for (const line of planTable(outcome.steps)) {
                 out.text(line);
             }
             let orphans = [];
+            let unowned = [];
+            let pending = [];
+            let retired = [];
+            let scanSkipped = [];
             if (targets === undefined) {
-                orphans = (await collectOrphans(graph, engineConfig)).map(({ id, type }) => ({ id, type }));
+                const scan = await collectOrphans(graph, engineConfig);
+                orphans = scan.orphans.map(({ id, type }) => ({ id, type }));
+                unowned = [...scan.unowned];
+                scanSkipped = [...scan.skipped];
+                pending =
+                    previous === undefined
+                        ? []
+                        : removedNodes(rewriteGraphForMoves(pruneBase(previous), graph.moved ?? []), graph).map(({ id, type }) => ({ id, type }));
+                lastActivity = "scanning retired hosts";
+                retired = (await scanRetiredHosts(previous?.retiredHosts ?? [], { ssh, env: process.env, owner, providers: engineConfig.providers })).map((hostScan) => ({
+                    id: hostScan.host.id,
+                    address: hostScan.host.address,
+                    leftovers: hostScan.leftovers.map(({ id, type }) => ({ id, type })),
+                    unowned: hostScan.unowned,
+                    ...(hostScan.error !== undefined ? { error: hostScan.error } : {}),
+                }));
             }
             else {
                 out.text("");
                 out.text("A targeted plan reads only the named resources, so the orphan scan was skipped.");
             }
-            for (const line of planSummary(outcome.steps, orphans)) {
+            for (const line of [
+                ...planSummary(outcome.steps, orphans),
+                ...unownedBlock(unowned),
+                ...pendingBlock(pending),
+                ...retiredBlock(retired),
+                ...scanGapBlock(scanSkipped),
+                ...(baselineError !== undefined ? ["", `The prune baseline cannot be read: ${baselineError}`] : []),
+            ]) {
                 out.text(line);
             }
-            out.result({ steps: outcome.steps, orphans });
+            const reasons = targets === undefined
+                ? driftReasons({
+                    steps: outcome.steps,
+                    orphans,
+                    unowned,
+                    pending,
+                    retired,
+                    scanSkipped,
+                    ...(baselineError !== undefined ? { baselineError } : {}),
+                })
+                : [];
+            out.result({ steps: outcome.steps, orphans, unowned, pendingDeletion: pending, retiredHosts: retired, scanSkipped, drift: reasons });
+            if (flags.check && reasons.length > 0) {
+                throw new Error(`drift check: ${reasons.join(", ")}. Run \`intentic deploy plan\` to see them, \`intentic deploy apply --yes\` to converge.`);
+            }
         };
         let deadline;
         try {

package/dist/plan/plan.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"plan.command.js","sourceRoot":"","sources":["../../src/plan/plan.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEpC,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAY;IAC/C,IAAI,EAAE,EAAE,KAAK,EAAE,iEAAiE,EAAE;IAClF,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,MAAM,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,8FAA8F;aACxG;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAgB;QAC7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5G,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1H,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;YACxB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAE1D,IAAI,YAAY,GAAG,2BAA2B,CAAC;QAC/C,MAAM,OAAO,GAAuB,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBACnD,YAAY,GAAG,WAAW,KAAK,CAAC,EAAE,EAAE,CAAC;YACzC,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;YAClC,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,YAAY,GAAG,OAAO,CAAC;YAC3B,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YAEnC,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9H,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,YAAY,GAAG,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;YAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,OAAO,GAAmC,EAAE,CAAC;YACjD,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAChG,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAChG,CAAC;YACD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACrD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YACD,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC;QAEF,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE;gBACN,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC7B,QAAQ,GAAG,UAAU,CACjB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,gBAAgB,GAAG,MAAM,qBAAqB,YAAY,EAAE,CAAC,CAAC,EACtG,gBAAgB,CACnB,CAAC;oBACF,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC,CAAC;aACL,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEvB,QAAQ,CAAC,KAAK,EAAE,CAAC;YAEjB,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}
+{"version":3,"file":"plan.command.js","sourceRoot":"","sources":["../../src/plan/plan.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAqB,IAAI,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAiB,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5F,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACjG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAc,YAAY,EAAE,WAAW,EAAE,SAAS,EAAsB,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAClJ,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAUvD,MAAM,gBAAgB,GAAG,CAAC,GAAG,MAAM,CAAC;AAcpC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAuB,EAAY,EAAE;IAC9D,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/G,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,MAAM,CAAC;IACrF,OAAO;QACH,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAClG,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,0BAA0B,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvH,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAC;AACN,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAY;IAC/C,IAAI,EAAE,EAAE,KAAK,EAAE,wEAAwE,EAAE;IACzF,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,MAAM,EAAE;gBACJ,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,8FAA8F;aACxG;YACD,QAAQ,EAAE;gBACN,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,MAAM;gBACb,QAAQ,EAAE,IAAI;gBACd,KAAK,EAAE,wCAAwC,iBAAiB,mDAAmD;aACtH;YACD,KAAK,EAAE;gBACH,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,+GAA+G;aACzH;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAgB;QAC7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAE5B,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAC5G,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC;QAC1H,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;QACvH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM;YACxB,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;aACtB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACrE,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QAEnC,MAAM,YAAY,GAAG,KAAK,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACpE,IAAI,QAA8B,CAAC;QACnC,IAAI,aAAiC,CAAC;QACtC,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzD,aAAa,GAAG,wBAAwB,YAAY,EAAE,CAAC;YAC3D,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,KAAK,CAAC;QAE5C,IAAI,YAAY,GAAG,2BAA2B,CAAC;QAC/C,MAAM,OAAO,GAAuB,CAAC,KAAK,EAAE,EAAE;YAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;gBACnD,YAAY,GAAG,WAAW,KAAK,CAAC,EAAE,EAAE,CAAC;YACzC,CAAC;YACD,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE;YAClC,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrC,YAAY,GAAG,OAAO,CAAC;YAC3B,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC,CAAC;QACF,MAAM,IAAI,GAAG,KAAK,IAAmB,EAAE;YAEnC,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAC9H,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC/E,MAAM,YAAY,GAAiB,EAAE,SAAS,EAAE,eAAe,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YACpI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YAChD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAED,IAAI,OAAO,GAAY,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAY,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAY,EAAE,CAAC;YAC1B,IAAI,OAAO,GAAoB,EAAE,CAAC;YAClC,IAAI,WAAW,GAA2D,EAAE,CAAC;YAC7E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBACxB,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;gBACvD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAC7D,OAAO,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC5B,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;gBAEhC,OAAO;oBACH,QAAQ,KAAK,SAAS;wBAClB,CAAC,CAAC,EAAE;wBACJ,CAAC,CAAC,YAAY,CAAC,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClI,YAAY,GAAG,wBAAwB,CAAC;gBACxC,OAAO,GAAG,CACN,MAAM,gBAAgB,CAAC,QAAQ,EAAE,YAAY,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,EAAE,CAAC,CAC5H,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;oBACjB,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE;oBACpB,OAAO,EAAE,QAAQ,CAAC,IAAI,CAAC,OAAO;oBAC9B,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;oBACnE,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,GAAG,CAAC,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACrE,CAAC,CAAC,CAAC;YACR,CAAC;iBAAM,CAAC;gBACJ,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAChG,CAAC;YACD,KAAK,MAAM,IAAI,IAAI;gBACf,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;gBACtC,GAAG,YAAY,CAAC,OAAO,CAAC;gBACxB,GAAG,YAAY,CAAC,OAAO,CAAC;gBACxB,GAAG,YAAY,CAAC,OAAO,CAAC;gBACxB,GAAG,YAAY,CAAC,WAAW,CAAC;gBAC5B,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,sCAAsC,aAAa,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACtG,EAAE,CAAC;gBACA,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YACD,MAAM,OAAO,GACT,OAAO,KAAK,SAAS;gBACjB,CAAC,CAAC,YAAY,CAAC;oBACT,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,OAAO;oBACP,WAAW;oBACX,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5D,CAAC;gBACJ,CAAC,CAAC,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;YACrI,IAAI,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CACX,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0FAA0F,CAC/H,CAAC;YACN,CAAC;QACL,CAAC,CAAC;QAEF,IAAI,QAAoC,CAAC;QACzC,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,IAAI,CAAC;gBACf,IAAI,EAAE;gBACN,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;oBAC7B,QAAQ,GAAG,UAAU,CACjB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iBAAiB,gBAAgB,GAAG,MAAM,qBAAqB,YAAY,EAAE,CAAC,CAAC,EACtG,gBAAgB,CACnB,CAAC;oBACF,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrB,CAAC,CAAC;aACL,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEvB,QAAQ,CAAC,KAAK,EAAE,CAAC;YAEjB,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/resolve/resolve.command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.command.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAIA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAoBlE,eAAO,MAAM,cAAc,iDA0EzB,CAAC"}
+{"version":3,"file":"resolve.command.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAKA,OAAO,EAAgB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AA4BlE,eAAO,MAAM,cAAc,iDA4EzB,CAAC"}

package/dist/resolve/resolve.command.js

@@ -14,7 +14,13 @@ import { syncControlPlaneSecrets } from "../pipelines/control-plane-sync.js";
 import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
 import { createLocalSecretStore } from "../secrets/secret-store.js";
 import { collectSecrets, writeEnvExample } from "../secrets/secrets.js";
-import { discoverZone, loadIntent } from "./resolve.js";
+import { discoverZone, loadIntent, ownerFor } from "./resolve.js";
+const withOwner = (graph, owner) => ({
+    version: graph.version,
+    ...(owner !== undefined ? { owner } : {}),
+    resources: graph.resources,
+    ...(graph.moved !== undefined ? { moved: graph.moved } : {}),
+});
 export const resolveCommand = buildCommand({
     docs: { brief: "Resolve a deploy.config.ts into the desired-state artifact" },
     parameters: {
@@ -37,7 +43,8 @@ export const resolveCommand = buildCommand({
         const dir = dirname(artifactOut);
         const previousGraph = flags.syncControlPlane && existsSync(artifactOut) ? await readArtifact(artifactOut) : undefined;
         const zone = await discoverZone(intent, dir);
-        const graph = resolveState(intent, zone);
+        const owner = await ownerFor(artifactOut, { mint: !flags.syncControlPlane, log: out.log });
+        const graph = withOwner(resolveState(intent, zone), owner);
         await writeArtifact(artifactOut, graph);
         const count = Object.keys(graph.resources).length;
         out.text(`resolved desired state (${plural(count, "resource")}) → ${artifactOut}`);
@@ -73,6 +80,7 @@ export const resolveCommand = buildCommand({
         }
         out.result({
             resources: count,
+            ...(owner !== undefined ? { owner } : {}),
             ...(zone !== undefined ? { zone } : {}),
             envSecrets: envKeys,
             generatedSecrets: generated,

package/dist/resolve/resolve.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.command.js","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAQxD,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAe;IACrD,IAAI,EAAE,EAAE,KAAK,EAAE,4DAA4D,EAAE;IAC7E,UAAU,EAAE;QACR,KAAK,EAAE;YACH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,WAAW,GAAG,EAAE;YACvH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,wCAAwC,aAAa,GAAG,EAAE;YACvH,gBAAgB,EAAE;gBACd,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,wIAAwI;aAClJ;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAI5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC7H,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACzC,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CACJ,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACvC,CAAC,CAAC,0BAA0B,IAAI,mBAAmB;gBACnD,CAAC,CAAC,+BAA+B,IAAI,sBAAsB,CAClE,CAAC;QACN,CAAC;QAKD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,sBAAsB,QAAQ,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAA8F,CAAC;QACnG,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,aAAa,2DAA2D,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBACnC,aAAa;gBACb,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG;gBACH,QAAQ;gBACR,UAAU,EAAE,OAAO;gBACnB,GAAG,EAAE,GAAG,CAAC,GAAG;aACf,CAAC,CAAC;QACP,CAAC;QACD,GAAG,CAAC,MAAM,CAAC;YACP,SAAS,EAAE,KAAK;YAChB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,OAAO;YACnB,gBAAgB,EAAE,SAAS;YAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}
+{"version":3,"file":"resolve.command.js","sourceRoot":"","sources":["../../src/resolve/resolve.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACvG,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGlE,MAAM,SAAS,GAAG,CAAC,KAAwB,EAAE,KAAyB,EAAqB,EAAE,CAAC,CAAC;IAC3F,OAAO,EAAE,KAAK,CAAC,OAAO;IACtB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACzC,SAAS,EAAE,KAAK,CAAC,SAAS;IAC1B,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAC/D,CAAC,CAAC;AAQH,MAAM,CAAC,MAAM,cAAc,GAAG,YAAY,CAAe;IACrD,IAAI,EAAE,EAAE,KAAK,EAAE,4DAA4D,EAAE;IAC7E,UAAU,EAAE;QACR,KAAK,EAAE;YACH,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,uCAAuC,WAAW,GAAG,EAAE;YACvH,GAAG,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,wCAAwC,aAAa,GAAG,EAAE;YACvH,gBAAgB,EAAE;gBACd,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE,wIAAwI;aAClJ;SACJ;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;QAI5B,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;QAChG,MAAM,UAAU,GAAG,MAAM,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,kBAAkB,EAAE,SAAS,CAAC,CAAC;QAC7H,MAAM,GAAG,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,YAAY,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACxG,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC;QAC7D,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,IAAI,aAAa,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;QAEjC,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB,IAAI,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QAC3D,MAAM,aAAa,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;QAClD,GAAG,CAAC,IAAI,CAAC,2BAA2B,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,OAAO,WAAW,EAAE,CAAC,CAAC;QACnF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CACJ,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,KAAK,SAAS;gBACvC,CAAC,CAAC,0BAA0B,IAAI,mBAAmB;gBACnD,CAAC,CAAC,+BAA+B,IAAI,sBAAsB,CAClE,CAAC;QACN,CAAC;QAKD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1D,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,UAAU,CAAC,EAAE,OAAO,CAAC,CAAC;YACjE,GAAG,CAAC,IAAI,CAAC,gBAAgB,QAAQ,sBAAsB,QAAQ,cAAc,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,sBAAsB,CAAC,sBAAsB,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClF,GAAG,CAAC,IAAI,CAAC,8CAA8C,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAA8F,CAAC;QACnG,IAAI,KAAK,CAAC,gBAAgB,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;gBAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,aAAa,2DAA2D,CAAC,CAAC;YACrG,CAAC;YACD,MAAM,GAAG,MAAM,uBAAuB,CAAC;gBACnC,aAAa;gBACb,QAAQ,EAAE,KAAK;gBACf,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG;gBACH,QAAQ;gBACR,UAAU,EAAE,OAAO;gBACnB,GAAG,EAAE,GAAG,CAAC,GAAG;aACf,CAAC,CAAC;QACP,CAAC;QACD,GAAG,CAAC,MAAM,CAAC;YACP,SAAS,EAAE,KAAK;YAChB,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvC,UAAU,EAAE,OAAO;YACnB,gBAAgB,EAAE,SAAS;YAC3B,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9C,CAAC,CAAC;IACP,CAAC;CACJ,CAAC,CAAC"}

package/dist/resolve/resolve.d.ts

@@ -1,4 +1,8 @@
-import type { IntentSet } from "@intentic/need-resolver";
+import type { IntentSet } from "@intentic/state-resolver";
 export declare const loadIntent: (configPath: string) => Promise<IntentSet>;
 export declare const discoverZone: (intent: IntentSet, dir: string) => Promise<string | undefined>;
+export declare const ownerFor: (artifactOut: string, options: {
+    readonly mint: boolean;
+    readonly log: (message: string) => void;
+}) => Promise<string | undefined>;
 //# sourceMappingURL=resolve.d.ts.map

package/dist/resolve/resolve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAQzD,eAAO,MAAM,UAAU,eAAsB,MAAM,KAAG,OAAO,CAAC,SAAS,CAMtE,CAAC;AAQF,eAAO,MAAM,YAAY,WAAkB,SAAS,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAsB7F,CAAC"}
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAS1D,eAAO,MAAM,UAAU,eAAsB,MAAM,KAAG,OAAO,CAAC,SAAS,CAMtE,CAAC;AAQF,eAAO,MAAM,YAAY,WAAkB,SAAS,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAsB7F,CAAC;AAKF,eAAO,MAAM,QAAQ,gBACJ,MAAM,WACV;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,KAC7E,OAAO,CAAC,MAAM,GAAG,SAAS,CAsB5B,CAAC"}

package/dist/resolve/resolve.js

@@ -1,8 +1,13 @@
-import { resolve } from "node:path";
+import { randomBytes } from "node:crypto";
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { errorMessage } from "@intentic/base/errors";
+import { isOwnerId } from "@intentic/graph";
 import { cloudflareApi } from "@intentic/providers";
 import { collectDomains, selectZone } from "@intentic/state-resolver";
-import { loadEnvFile } from "../lib/artifact.js";
+import { readBaseline } from "../apply/baseline.js";
+import { LAST_APPLIED_FILE, loadEnvFile, readArtifact } from "../lib/artifact.js";
 export const loadIntent = async (configPath) => {
     const loaded = (await import(pathToFileURL(resolve(configPath)).href));
     if (loaded.intent === undefined) {
@@ -30,4 +35,28 @@ export const discoverZone = async (intent, dir) => {
     const zones = await cloudflareApi.listZones({ apiToken });
     return selectZone(zones.map((zone) => zone.name), collectDomains(intent));
 };
+export const ownerFor = async (artifactOut, options) => {
+    const sources = [
+        { what: "the artifact", read: async () => (existsSync(artifactOut) ? (await readArtifact(artifactOut)).owner : undefined) },
+        { what: "the prune baseline", read: async () => (await readBaseline(join(dirname(artifactOut), LAST_APPLIED_FILE)))?.owner },
+    ];
+    for (const source of sources) {
+        try {
+            const owner = await source.read();
+            if (owner !== undefined && isOwnerId(owner)) {
+                return owner;
+            }
+        }
+        catch (error) {
+            options.log(`resolve: could not read the owner id from ${source.what}: ${errorMessage(error)}`);
+        }
+    }
+    if (!options.mint) {
+        options.log("resolve: no owner id yet and this run does not mint one; the next resolve in the workspace does");
+        return undefined;
+    }
+    const minted = randomBytes(6).toString("hex");
+    options.log(`resolve: minted owner id ${minted} for this intent; it is stamped on everything it deploys`);
+    return minted;
+};
 //# sourceMappingURL=resolve.js.map

package/dist/resolve/resolve.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKjD,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAkB,EAAsB,EAAE;IACvE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAA2B,CAAC;IACjG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACzB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAiB,EAAE,GAAW,EAA+B,EAAE;IAC9F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,6FAA6F,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,UAAU,CACb,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,cAAc,CAAC,MAAM,CAAC,CACzB,CAAC;AACN,CAAC,CAAC"}
+{"version":3,"file":"resolve.js","sourceRoot":"","sources":["../../src/resolve/resolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAKlF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,EAAE,UAAkB,EAAsB,EAAE;IACvE,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAA2B,CAAC;IACjG,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2CAA2C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;AACzB,CAAC,CAAC;AAQF,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAAE,MAAiB,EAAE,GAAW,EAA+B,EAAE;IAC9F,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IACrC,IAAI,UAAU,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QACzF,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACtC,OAAO,UAAU,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,WAAW,CAAC,GAAG,CAAC,CAAC;IACjB,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,2DAA2D,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,GAAG,6FAA6F,CAAC,CAAC;IACnI,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1D,OAAO,UAAU,CACb,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,cAAc,CAAC,MAAM,CAAC,CACzB,CAAC;AACN,CAAC,CAAC;AAKF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,EACzB,WAAmB,EACnB,OAA4E,EACjD,EAAE;IAC7B,MAAM,OAAO,GAAG;QACZ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE;QAC3H,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE;KAC/H,CAAC;IACF,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAAK,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC1C,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,6CAA6C,MAAM,CAAC,IAAI,KAAK,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iGAAiG,CAAC,CAAC;QAC/G,OAAO,SAAS,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,4BAA4B,MAAM,0DAA0D,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC;AAClB,CAAC,CAAC"}

package/dist/restore/restore.command.js

@@ -1,10 +1,10 @@
 import { dirname } from "node:path";
 import { createStore, resolveInputs } from "@intentic/engine";
-import { createSshExecutor, hostTarget, restoreBackup } from "@intentic/providers";
+import { hostTarget, restoreBackup } from "@intentic/providers";
 import { buildCommand } from "@stricli/core";
 import { loadConfig } from "../env.config.js";
 import { ARTIFACT_PATH, loadEnvFile, readArtifact } from "../lib/artifact.js";
-import { createKnownHostsStore } from "../lib/known-hosts.js";
+import { pinnedSshExecutor } from "../lib/known-hosts.js";
 import { createOutput } from "../lib/output.js";
 import { withRunLog } from "../lib/run-log.js";
 import { ensureGeneratedSecrets } from "../secrets/generated-secrets.js";
@@ -40,7 +40,7 @@ export const restore = buildCommand({
         const dir = dirname(artifact);
         loadEnvFile(dir);
         const graph = await readArtifact(artifact);
-        const ssh = createSshExecutor(createKnownHostsStore(dir));
+        const ssh = pinnedSshExecutor(dir);
         try {
             await ensureGeneratedSecrets(generatedSecretStore(graph, dir, ssh, false, out.log), collectSecrets(graph).generated, process.env);
             const backupNode = Object.values(graph.resources).find((node) => node.type === "backup");

package/dist/restore/restore.command.js.map

@@ -1 +1 @@
-{"version":3,"file":"restore.command.js","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAqB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAErD,MAAM,YAAY,GAAG,CAAC,IAAwB,EAAgB,EAAE;IAC5D,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAqB,CAAC;AACjC,CAAC,CAAC;AAGF,MAAM,UAAU,GAAG,CAAC,KAAmB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAIrG,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAA0B,EAAE;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC9H,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAe;IAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,yFAAyF,EAAE;IAC1G,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iDAAiD,EAAE;YACrH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,yDAAyD,EAAE;SAC5H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAG3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACD,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClI,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAGvC,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,aAAa,CAAC;gBAChB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;gBAC5B,KAAK;gBACL,IAAI;gBACJ,QAAQ;gBACR,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;gBACpC,KAAK;gBACL,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,QAAQ,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;YAG5C,GAAG,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,kBAAkB,QAAQ,GAAG,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YAGP,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}
+{"version":3,"file":"restore.command.js","sourceRoot":"","sources":["../../src/restore/restore.command.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAqB,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAuB,MAAM,eAAe,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAQvD,MAAM,MAAM,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAU,CAAC;AAErD,MAAM,YAAY,GAAG,CAAC,IAAwB,EAAgB,EAAE;IAC5D,MAAM,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC;IAC5B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAqB,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,yBAAyB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,KAAqB,CAAC;AACjC,CAAC,CAAC;AAGF,MAAM,UAAU,GAAG,CAAC,KAAmB,EAAU,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAIrG,MAAM,iBAAiB,GAAG,CAAC,GAAY,EAA0B,EAAE;IAC/D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;AAC9H,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAe;IAC9C,IAAI,EAAE,EAAE,KAAK,EAAE,yFAAyF,EAAE;IAC1G,UAAU,EAAE;QACR,KAAK,EAAE;YACH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,aAAa,GAAG,EAAE;YACtH,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,iDAAiD,EAAE;YACrH,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,yDAAyD,EAAE;SAC5H;KACJ;IACD,KAAK,CAAC,IAAI,CAAuB,KAAmB;QAChD,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,UAAU,EAAE,CAAC,cAAc,CAAC,CAAC;QAClG,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,aAAa,CAAC;QACjD,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC9B,WAAW,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAG3C,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC;YACD,MAAM,sBAAsB,CAAC,oBAAoB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;YAClI,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;YACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uFAAuF,CAAC,CAAC;YAC7G,CAAC;YACD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAGvC,MAAM,QAAQ,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAClG,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9B,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACxF,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YACjF,CAAC;YACD,MAAM,aAAa,CAAC;gBAChB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC;gBAC5B,KAAK;gBACL,IAAI;gBACJ,QAAQ;gBACR,WAAW,EAAE,iBAAiB,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;gBACvD,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,QAAQ;gBACpC,KAAK;gBACL,GAAG,EAAE,GAAG,CAAC,GAAG;gBACZ,QAAQ,EAAE,GAAG;aAChB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,QAAQ,CAAC;YAG5C,GAAG,CAAC,IAAI,CAAC,YAAY,UAAU,CAAC,KAAK,CAAC,kBAAkB,QAAQ,GAAG,CAAC,CAAC;YACrE,GAAG,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;YAC9F,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YAGP,MAAM,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/secrets/generated-secrets.d.ts

@@ -1,6 +1,7 @@
 import type { SecretStore } from "./secret-store.js";
 type MutableEnv = Record<string, string | undefined>;
 export declare const ensureGeneratedSecrets: (store: SecretStore, keys: readonly string[], env: MutableEnv) => Promise<void>;
+export declare const loadStoredSecrets: (store: SecretStore, keys: readonly string[], env: MutableEnv, log: (message: string) => void) => Promise<string[]>;
 export declare const readGeneratedSecrets: (dir: string) => Promise<Record<string, string>>;
 export {};
 //# sourceMappingURL=generated-secrets.d.ts.map

package/dist/secrets/generated-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generated-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAQrD,eAAO,MAAM,sBAAsB,UAAiB,WAAW,QAAQ,SAAS,MAAM,EAAE,OAAO,UAAU,KAAG,OAAO,CAAC,IAAI,CAcvH,CAAC;AAIF,eAAO,MAAM,oBAAoB,QAAe,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtF,CAAC"}
+{"version":3,"file":"generated-secrets.d.ts","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAQrD,eAAO,MAAM,sBAAsB,UAAiB,WAAW,QAAQ,SAAS,MAAM,EAAE,OAAO,UAAU,KAAG,OAAO,CAAC,IAAI,CAcvH,CAAC;AAMF,eAAO,MAAM,iBAAiB,UACnB,WAAW,QACZ,SAAS,MAAM,EAAE,OAClB,UAAU,OACV,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC/B,OAAO,CAAC,MAAM,EAAE,CAmBlB,CAAC;AAIF,eAAO,MAAM,oBAAoB,QAAe,MAAM,KAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGtF,CAAC"}

package/dist/secrets/generated-secrets.js

@@ -2,6 +2,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync } from "node:fs";
 import { readFile } from "node:fs/promises";
 import { join } from "node:path";
+import { errorMessage } from "@intentic/base/errors";
 import { SECRETS_FILE } from "../lib/artifact.js";
 const generate = () => randomBytes(16).toString("hex");
 export const ensureGeneratedSecrets = async (store, keys, env) => {
@@ -19,6 +20,27 @@ export const ensureGeneratedSecrets = async (store, keys, env) => {
         env[key] = value;
     }
 };
+export const loadStoredSecrets = async (store, keys, env, log) => {
+    const unloaded = [];
+    for (const key of keys) {
+        if (env[key] !== undefined && env[key] !== "") {
+            continue;
+        }
+        try {
+            const existing = await store.get(key);
+            if (existing === undefined) {
+                unloaded.push(key);
+                continue;
+            }
+            env[key] = existing;
+        }
+        catch (error) {
+            log(`secrets: could not load "${key}" for a pruned resource, deleting without it: ${errorMessage(error)}`);
+            unloaded.push(key);
+        }
+    }
+    return unloaded;
+};
 export const readGeneratedSecrets = async (dir) => {
     const path = join(dir, SECRETS_FILE);
     return existsSync(path) ? JSON.parse(await readFile(path, "utf8")) : {};

package/dist/secrets/generated-secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"generated-secrets.js","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAI/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAkB,EAAE,IAAuB,EAAE,GAAe,EAAiB,EAAE;IACxH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC,CAAC"}
+{"version":3,"file":"generated-secrets.js","sourceRoot":"","sources":["../../src/secrets/generated-secrets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD,MAAM,QAAQ,GAAG,GAAW,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAI/D,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAAE,KAAkB,EAAE,IAAuB,EAAE,GAAe,EAAiB,EAAE;IACxH,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;YACpB,SAAS;QACb,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC5B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;AACL,CAAC,CAAC;AAMF,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,EAClC,KAAkB,EAClB,IAAuB,EACvB,GAAe,EACf,GAA8B,EACb,EAAE;IACnB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC;YAC5C,SAAS;QACb,CAAC;QACD,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACnB,SAAS;YACb,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC;QACxB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,4BAA4B,GAAG,iDAAiD,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3G,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,GAAW,EAAmC,EAAE;IACvF,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA4B,CAAC,CAAC,CAAC,EAAE,CAAC;AACxG,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentic/cli",
-  "version": "1.326.0",
+  "version": "1.327.0",
   "description": "",
   "license": "MIT",
   "type": "module",
@@ -34,16 +34,15 @@
     }
   },
   "dependencies": {
-    "@intentic/base": "1.326.0",
-    "@intentic/constants": "1.326.0",
-    "@intentic/engine": "1.326.0",
-    "@intentic/graph": "1.326.0",
-    "@intentic/need-resolver": "1.326.0",
-    "@intentic/providers": "1.326.0",
-    "@intentic/sandbox-contract": "1.326.0",
-    "@intentic/sandbox-run": "1.326.0",
-    "@intentic/scaffold": "1.326.0",
-    "@intentic/state-resolver": "1.326.0",
+    "@intentic/base": "1.327.0",
+    "@intentic/constants": "1.327.0",
+    "@intentic/engine": "1.327.0",
+    "@intentic/graph": "1.327.0",
+    "@intentic/providers": "1.327.0",
+    "@intentic/sandbox-contract": "1.327.0",
+    "@intentic/sandbox-run": "1.327.0",
+    "@intentic/scaffold": "1.327.0",
+    "@intentic/state-resolver": "1.327.0",
     "@puristic/env": "1.6.1",
     "@stricli/core": "1.3.0",
     "eta": "4.6.0",
@@ -52,15 +51,15 @@
   },
   "devDependencies": {
     "@intentic/dind-host": "0.0.0",
-    "@intentic/sdk": "1.326.0",
+    "@intentic/sdk": "1.327.0",
     "@intentic/testing": "0.0.0",
     "@intentic/tsconfig": "0.0.0",
     "@types/bun": "1.4.2",
-    "@types/node": "24.13.6",
+    "@types/node": "24.19.1",
     "@types/ssh2": "1.15.6",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "ssh2": "1.17.0",
-    "testcontainers": "12.1.0",
+    "testcontainers": "12.2.0",
     "tsx": "4.23.15",
     "yaml": "2.9.1"
   },

package/templates/workflows/apply.yaml.eta

@@ -1,10 +1,15 @@
-# Generated by intentic: apply the desired-state artifact, pruning resources it no longer declares.
+# Generated by intentic: apply the desired-state artifact on every push to it, pruning what it no longer declares; and
+# once a day, check for drift without changing anything, failing the run when something needs applying or a person.
 on:
   push:
     branches: [ "main" ]
     paths: [ "<%= it.artifactFile %>" ]
+  schedule:
+    - cron: "<%= it.driftCron %>"
 jobs:
-  apply:
+<% ["apply", "drift"].forEach(function (job) { -%>
+  <%= job %>:
+    if: github.event_name == '<%= job === "apply" ? "push" : "schedule" %>'
     runs-on: docker
     env:
 <% it.envEntries.forEach(function (entry) { -%>
@@ -14,15 +19,30 @@ jobs:
       - uses: https://github.com/actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
-      - name: apply and prune
+      - name: <%= job === "apply" ? "apply and prune" : "drift check" %>
         run: |
+          set -e
           corepack enable
+          # The prune baseline: an annotated tag carries the whole record; a plain one (before 2026-10-05) points at the
+          # applied artifact. A tag that exists but cannot be read fails here, never reads as "no baseline".
           PREV=''
-          if git rev-parse -q --verify refs/tags/<%= it.appliedTag %> >/dev/null; then \
-            git show <%= it.appliedTag %>:<%= it.artifactFile %> > /tmp/previous.json && PREV="--previous /tmp/previous.json"; fi
+          if git rev-parse -q --verify refs/tags/<%= it.appliedTag %> >/dev/null; then
+            if [ "$(git cat-file -t refs/tags/<%= it.appliedTag %>)" = tag ]; then
+              git tag -l --format='%(contents)' <%= it.appliedTag %> > /tmp/previous.json
+            else
+              git show <%= it.appliedTag %>:<%= it.artifactFile %> > /tmp/previous.json
+            fi
+            PREV="--previous /tmp/previous.json"
+          fi
+<% if (job === "apply") { -%>
           pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> deploy apply --yes --artifact <%= it.artifactFile %> $PREV
       - name: mark applied
         run: |
+          set -e
           AUTH="$(printf '%s:%s' '<%= it.user %>' "$<%= it.forgejoPasswordKey %>" | base64 -w0)"
-          git tag -f <%= it.appliedTag %> HEAD
+          git -c user.name='<%= it.user %>' -c user.email='<%= it.user %>@<%= it.domain %>' tag -f -a --cleanup=verbatim -F <%= it.baselineFile %> <%= it.appliedTag %> HEAD
           git -c http.extraHeader="Authorization: basic $AUTH" push -f origin refs/tags/<%= it.appliedTag %>
+<% } else { -%>
+          pnpm dlx <%= it.cliPackage %>@<%= it.cliVersion %> deploy plan --check --artifact <%= it.artifactFile %> $PREV
+<% } -%>
+<% }) -%>