@intentic/providers 1.18.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Artur Kurowski
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,26 @@
+# @intentic/providers
+
+The real **Provider SPI implementations** the engine reconciles against — the only seam between a compiled graph and live infrastructure. Each provider does `read` (stateless introspection), `diff` (pure decision), and `apply` (create/update) over SSH/Docker and the Forgejo/Komodo/Cloudflare/Authentik HTTP APIs. Depends on [`@intentic/engine`](../engine) (SPI types) + [`@intentic/graph`](../graph).
+
+## Responsibilities
+
+- Implement one provider per `ResourceType` and assemble them into the `ResourceType → Provider` map (`createProviders`).
+- Wrap external systems behind injectable API adapters (Forgejo, Komodo, Cloudflare, Authentik, Discord, Garage) so providers stay testable.
+- Own the host/SSH transport, Docker operations, DNS/tunnel routes, repos/CI, deployments, backups/restore, and identity (users/orgs/teams).
+- Validate node inputs with zod (`parseInputs`) before any I/O.
+
+## Key files
+
+- [src/index.ts](src/index.ts) — `createProviders` + `ProviderDeps`; re-points to every `create*Provider` factory.
+- `src/<kind>.ts` — one provider per kind: e.g. [src/cloudflare.ts](src/cloudflare.ts), [src/forgejo.ts](src/forgejo.ts), [src/komodo.ts](src/komodo.ts), [src/deployment.ts](src/deployment.ts), [src/cf-route.ts](src/cf-route.ts), [src/ci.ts](src/ci.ts).
+- `src/<system>-api.ts` — HTTP adapters: [src/forgejo-api.ts](src/forgejo-api.ts), [src/komodo-api.ts](src/komodo-api.ts), [src/cloudflare-api.ts](src/cloudflare-api.ts), [src/authentik-api.ts](src/authentik-api.ts); fakes like [src/forgejo-api.fake.ts](src/forgejo-api.fake.ts).
+- [src/backing-ssh.ts](src/backing-ssh.ts) — `sshExecutor` (+ `SshExecutor`/`SshSession`); [src/api-validation.test.ts](src/api-validation.test.ts) — input-validation coverage.
+
+## How it fits
+
+The infra boundary. `engine` defines the SPI and consumes a `Providers` map; this package is the production implementation of that map (the `cli` builds it via `createProviders`). Tests inject the fakes instead.
+
+## Conventions & gotchas
+
+- Providers are constructed from injected deps/adapters — never reach for ambient globals; pass a fake adapter in tests.
+- Keep `diff` pure: do all reads in `read`, all mutations in `apply`. Stamp created resources (`intentic.id=<id>`) for future orphan detection. See [ARCHITECTURE.md](../../ARCHITECTURE.md).

package/dist/app.d.ts

@@ -0,0 +1,4 @@
+import type { Provider } from "@intentic/engine";
+import type { KomodoApi } from "./komodo-api.js";
+export declare const createAppProvider: (api?: KomodoApi) => Provider;
+//# sourceMappingURL=app.d.ts.map

package/dist/app.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,kBAAkB,CAAC;AAGjE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAmDjD,eAAO,MAAM,iBAAiB,GAAI,MAAK,SAAqB,KAAG,QAgC7D,CAAC"}

package/dist/app.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+import { gitProvider, parseInputs } from "./inputs.js";
+import { komodoApi } from "./komodo-api.js";
+const appSchema = z.object({
+    komodoUrl: z.string(),
+    adminUser: z.string(),
+    adminPassword: z.string(),
+    repoName: z.string(),
+    gitInternalUrl: z.string(),
+});
+const parse = (inputs) => parseInputs(appSchema, inputs, "app");
+const SERVER = "Local";
+const BUILDER = "Local";
+const buildConfig = (parsed, builderId) => {
+    const git = gitProvider(parsed.gitInternalUrl);
+    return {
+        builder_id: builderId,
+        repo: `${parsed.adminUser}/${parsed.repoName}`,
+        git_provider: git.domain,
+        git_account: parsed.adminUser,
+        git_https: git.https,
+    };
+};
+const ensureBuilder = async (api, baseUrl, jwt) => {
+    const find = async () => (await api.listBuilders({ baseUrl, jwt })).find((item) => item.name === BUILDER)?.id;
+    const existing = await find();
+    if (existing !== undefined) {
+        return existing;
+    }
+    await api.createBuilder({ baseUrl, jwt, name: BUILDER, config: { type: "Server", params: { server_id: SERVER } } });
+    const created = await find();
+    if (created === undefined) {
+        throw new Error("komodo Server builder was not created");
+    }
+    return created;
+};
+export const createAppProvider = (api = komodoApi) => ({
+    read: async (inputs, ctx) => {
+        if (typeof inputs["komodoUrl"] !== "string") {
+            return undefined;
+        }
+        const parsed = parse(inputs);
+        try {
+            const jwt = await api.login({ baseUrl: parsed.komodoUrl, username: parsed.adminUser, password: parsed.adminPassword });
+            const build = (await api.listBuilds({ baseUrl: parsed.komodoUrl, jwt })).find((item) => item.name === ctx.id);
+            if (build === undefined) {
+                return undefined;
+            }
+            return { outputs: {} };
+        }
+        catch (error) {
+            ctx.log(`app "${ctx.id}": komodo not reachable yet, treating as not-yet-created: ${String(error)}`);
+            return undefined;
+        }
+    },
+    diff: () => ({ action: "noop" }),
+    apply: async (inputs, _observed, ctx) => {
+        const parsed = parse(inputs);
+        const jwt = await api.login({ baseUrl: parsed.komodoUrl, username: parsed.adminUser, password: parsed.adminPassword });
+        const builderId = await ensureBuilder(api, parsed.komodoUrl, jwt);
+        const config = buildConfig(parsed, builderId);
+        const existing = (await api.listBuilds({ baseUrl: parsed.komodoUrl, jwt })).find((item) => item.name === ctx.id);
+        if (existing === undefined) {
+            await api.createBuild({ baseUrl: parsed.komodoUrl, jwt, name: ctx.id, config });
+        }
+        else {
+            await api.updateBuild({ baseUrl: parsed.komodoUrl, jwt, id: existing.id, config });
+        }
+        return {};
+    },
+});
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEvD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC;IACvB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IAEpB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;CAC7B,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,MAAsB,EAAa,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAK3F,MAAM,MAAM,GAAG,OAAO,CAAC;AACvB,MAAM,OAAO,GAAG,OAAO,CAAC;AAKxB,MAAM,WAAW,GAAG,CAAC,MAAiB,EAAE,SAAiB,EAA2B,EAAE;IAClF,MAAM,GAAG,GAAG,WAAW,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC/C,OAAO;QACH,UAAU,EAAE,SAAS;QACrB,IAAI,EAAE,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,QAAQ,EAAE;QAC9C,YAAY,EAAE,GAAG,CAAC,MAAM;QACxB,WAAW,EAAE,MAAM,CAAC,SAAS;QAC7B,SAAS,EAAE,GAAG,CAAC,KAAK;KACvB,CAAC;AACN,CAAC,CAAC;AAGF,MAAM,aAAa,GAAG,KAAK,EAAE,GAAc,EAAE,OAAe,EAAE,GAAW,EAAmB,EAAE;IAC1F,MAAM,IAAI,GAAG,KAAK,IAAiC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,EAAE,EAAE,CAAC;IAC3I,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC;IAC9B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,QAAQ,CAAC;IACpB,CAAC;IACD,MAAM,GAAG,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IACpH,MAAM,OAAO,GAAG,MAAM,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,MAAiB,SAAS,EAAY,EAAE,CAAC,CAAC;IACxE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,OAAO,MAAM,CAAC,WAAW,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1C,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;YACvH,MAAM,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;YAC9G,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACtB,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,EAAE,6DAA6D,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpG,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IACD,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC;QACvH,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QACjH,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzB,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;aAAM,CAAC;YACJ,MAAM,GAAG,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,EAAE,CAAC;IACd,CAAC;CACJ,CAAC,CAAC"}

package/dist/authentik-api.d.ts

@@ -0,0 +1,23 @@
+export interface AuthentikClientSpec {
+    readonly baseUrl: string;
+    readonly token: string;
+    readonly slug: string;
+    readonly clientId: string;
+    readonly clientSecret: string;
+    readonly redirectDomains: readonly string[];
+}
+export interface AuthentikApi {
+    readonly findApplication: (args: {
+        readonly baseUrl: string;
+        readonly token: string;
+        readonly slug: string;
+    }) => Promise<boolean>;
+    readonly ensureClient: (spec: AuthentikClientSpec) => Promise<void>;
+    readonly deleteClient: (args: {
+        readonly baseUrl: string;
+        readonly token: string;
+        readonly slug: string;
+    }) => Promise<void>;
+}
+export declare const authentikApi: AuthentikApi;
+//# sourceMappingURL=authentik-api.d.ts.map

package/dist/authentik-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik-api.d.ts","sourceRoot":"","sources":["../src/authentik-api.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,mBAAmB;IAChC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,YAAY;IAEzB,QAAQ,CAAC,eAAe,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAElI,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,mBAAmB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpE,QAAQ,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/H;AAuCD,eAAO,MAAM,YAAY,EAAE,YAuC1B,CAAC"}

package/dist/authentik-api.js

@@ -0,0 +1,67 @@
+import { z } from "zod";
+import { parseResponse } from "./inputs.js";
+const listSchema = z.object({ results: z.array(z.object({ pk: z.union([z.number(), z.string()]) })) });
+const scopeListSchema = z.object({ results: z.array(z.object({ pk: z.string(), scope_name: z.string() })) });
+const call = async (method, baseUrl, token, path, body) => {
+    const response = await fetch(`${baseUrl}/api/v3${path}`, {
+        method,
+        headers: { Authorization: `Bearer ${token}`, ...(body !== undefined ? { "Content-Type": "application/json" } : {}) },
+        ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+    });
+    if (!response.ok) {
+        throw new Error(`authentik ${method} ${path} failed (${response.status}): ${(await response.text()).slice(0, 500)}`);
+    }
+    return response;
+};
+const get = async (baseUrl, token, path) => (await call("GET", baseUrl, token, path)).json();
+const flowPk = async (baseUrl, token, slug) => {
+    const result = parseResponse(z.object({ pk: z.union([z.number(), z.string()]) }), await get(baseUrl, token, `/flows/instances/${slug}/`), "authentik flow");
+    return result.pk;
+};
+const scopePks = async (baseUrl, token) => {
+    const result = parseResponse(scopeListSchema, await get(baseUrl, token, "/propertymappings/provider/scope/?page_size=100"), "authentik scopes");
+    return result.results.filter((mapping) => ["openid", "email", "profile"].includes(mapping.scope_name)).map((mapping) => mapping.pk);
+};
+const firstPk = (value) => parseResponse(listSchema, value, "authentik list").results[0]?.pk;
+const escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+export const authentikApi = {
+    findApplication: async ({ baseUrl, token, slug }) => firstPk(await get(baseUrl, token, `/core/applications/?slug=${slug}`)) !== undefined,
+    ensureClient: async ({ baseUrl, token, slug, clientId, clientSecret, redirectDomains }) => {
+        const [authorizationFlow, invalidationFlow, propertyMappings] = await Promise.all([
+            flowPk(baseUrl, token, "default-provider-authorization-implicit-consent"),
+            flowPk(baseUrl, token, "default-provider-invalidation-flow"),
+            scopePks(baseUrl, token),
+        ]);
+        const providerBody = {
+            name: slug,
+            authorization_flow: authorizationFlow,
+            invalidation_flow: invalidationFlow,
+            client_type: "confidential",
+            client_id: clientId,
+            client_secret: clientSecret,
+            redirect_uris: redirectDomains.map((domain) => ({ matching_mode: "regex", url: `^https://${escapeRegex(domain)}/.*$` })),
+            property_mappings: propertyMappings,
+            sub_mode: "hashed_user_id",
+        };
+        const providerPk = firstPk(await get(baseUrl, token, `/providers/oauth2/?name=${slug}`));
+        const provider = providerPk !== undefined
+            ? await call("PUT", baseUrl, token, `/providers/oauth2/${providerPk}/`, providerBody)
+            : await call("POST", baseUrl, token, "/providers/oauth2/", providerBody);
+        const pk = parseResponse(z.object({ pk: z.union([z.number(), z.string()]) }), await provider.json(), "authentik provider").pk;
+        const appBody = { name: slug, slug, provider: pk };
+        if (await authentikApi.findApplication({ baseUrl, token, slug })) {
+            await call("PATCH", baseUrl, token, `/core/applications/${slug}/`, { provider: pk });
+        }
+        else {
+            await call("POST", baseUrl, token, "/core/applications/", appBody);
+        }
+    },
+    deleteClient: async ({ baseUrl, token, slug }) => {
+        await call("DELETE", baseUrl, token, `/core/applications/${slug}/`).catch(() => undefined);
+        const providerPk = firstPk(await get(baseUrl, token, `/providers/oauth2/?name=${slug}`));
+        if (providerPk !== undefined) {
+            await call("DELETE", baseUrl, token, `/providers/oauth2/${providerPk}/`).catch(() => undefined);
+        }
+    },
+};
+//# sourceMappingURL=authentik-api.js.map

package/dist/authentik-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik-api.js","sourceRoot":"","sources":["../src/authentik-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA2B5C,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AACvG,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;AAG7G,MAAM,IAAI,GAAG,KAAK,EAAE,MAAc,EAAE,OAAe,EAAE,KAAa,EAAE,IAAY,EAAE,IAAc,EAAqB,EAAE;IACnH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,IAAI,EAAE,EAAE;QACrD,MAAM;QACN,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACpH,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,aAAa,MAAM,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,CAAC;IACD,OAAO,QAAQ,CAAC;AACpB,CAAC,CAAC;AAEF,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,IAAY,EAAoB,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAGvI,MAAM,MAAM,GAAG,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,IAAY,EAA4B,EAAE;IAC5F,MAAM,MAAM,GAAG,aAAa,CACxB,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EACnD,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,oBAAoB,IAAI,GAAG,CAAC,EACtD,gBAAgB,CACnB,CAAC;IACF,OAAO,MAAM,CAAC,EAAE,CAAC;AACrB,CAAC,CAAC;AAGF,MAAM,QAAQ,GAAG,KAAK,EAAE,OAAe,EAAE,KAAa,EAAqB,EAAE;IACzE,MAAM,MAAM,GAAG,aAAa,CAAC,eAAe,EAAE,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,iDAAiD,CAAC,EAAE,kBAAkB,CAAC,CAAC;IAChJ,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AACxI,CAAC,CAAC;AAEF,MAAM,OAAO,GAAG,CAAC,KAAc,EAA+B,EAAE,CAAC,aAAa,CAAC,UAAU,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACnI,MAAM,WAAW,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAE5F,MAAM,CAAC,MAAM,YAAY,GAAiB;IACtC,eAAe,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,4BAA4B,IAAI,EAAE,CAAC,CAAC,KAAK,SAAS;IACzI,YAAY,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,eAAe,EAAE,EAAE,EAAE;QACtF,MAAM,CAAC,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC9E,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,iDAAiD,CAAC;YACzE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,oCAAoC,CAAC;YAC5D,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC;SAC3B,CAAC,CAAC;QACH,MAAM,YAAY,GAAG;YACjB,IAAI,EAAE,IAAI;YACV,kBAAkB,EAAE,iBAAiB;YACrC,iBAAiB,EAAE,gBAAgB;YACnC,WAAW,EAAE,cAAc;YAC3B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,aAAa,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YACxH,iBAAiB,EAAE,gBAAgB;YACnC,QAAQ,EAAE,gBAAgB;SAC7B,CAAC;QACF,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,MAAM,QAAQ,GACV,UAAU,KAAK,SAAS;YACpB,CAAC,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,UAAU,GAAG,EAAE,YAAY,CAAC;YACrF,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC;QACjF,MAAM,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC;QAC9H,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnD,IAAI,MAAM,YAAY,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,IAAI,GAAG,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;aAAM,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,EAAE,OAAO,CAAC,CAAC;QACvE,CAAC;IACL,CAAC;IACD,YAAY,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;QAC7C,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,sBAAsB,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3F,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,2BAA2B,IAAI,EAAE,CAAC,CAAC,CAAC;QACzF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpG,CAAC;IACL,CAAC;CACJ,CAAC"}

package/dist/authentik-client.d.ts

@@ -0,0 +1,4 @@
+import type { Provider } from "@intentic/engine";
+import type { AuthentikApi } from "./authentik-api.js";
+export declare const createAuthentikClientProvider: (api?: AuthentikApi) => Provider;
+//# sourceMappingURL=authentik-client.d.ts.map

package/dist/authentik-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik-client.d.ts","sourceRoot":"","sources":["../src/authentik-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,kBAAkB,CAAC;AAEjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAkCvD,eAAO,MAAM,6BAA6B,GAAI,MAAK,YAA2B,KAAG,QA6B/E,CAAC"}

package/dist/authentik-client.js

@@ -0,0 +1,50 @@
+import { z } from "zod";
+import { authentikApi } from "./authentik-api.js";
+import { parseInputs } from "./inputs.js";
+const clientSchema = z.object({
+    authentikUrl: z.string(),
+    bootstrapToken: z.string(),
+    domain: z.string(),
+    slug: z.string(),
+    clientId: z.string(),
+    clientSecret: z.string(),
+    redirectDomains: z.array(z.string()).default([]),
+});
+const parse = (inputs) => parseInputs(clientSchema, inputs, "authentik-client");
+const issuer = (parsed) => `https://${parsed.domain}/application/o/${parsed.slug}/`;
+const outputsFor = (parsed) => ({
+    issuer: issuer(parsed),
+    clientId: parsed.clientId,
+    clientSecret: parsed.clientSecret,
+});
+export const createAuthentikClientProvider = (api = authentikApi) => ({
+    read: async (inputs, ctx) => {
+        const parsed = parse(inputs);
+        try {
+            const exists = await api.findApplication({ baseUrl: parsed.authentikUrl, token: parsed.bootstrapToken, slug: parsed.slug });
+            return exists ? { outputs: outputsFor(parsed) } : undefined;
+        }
+        catch (error) {
+            ctx.log(`authentik-client "${ctx.id}": authentik not reachable yet, treating as not-yet-created: ${String(error)}`);
+            return undefined;
+        }
+    },
+    diff: () => ({ action: "noop" }),
+    apply: async (inputs) => {
+        const parsed = parse(inputs);
+        await api.ensureClient({
+            baseUrl: parsed.authentikUrl,
+            token: parsed.bootstrapToken,
+            slug: parsed.slug,
+            clientId: parsed.clientId,
+            clientSecret: parsed.clientSecret,
+            redirectDomains: parsed.redirectDomains,
+        });
+        return outputsFor(parsed);
+    },
+    delete: async (inputs) => {
+        const parsed = parse(inputs);
+        await api.deleteClient({ baseUrl: parsed.authentikUrl, token: parsed.bootstrapToken, slug: parsed.slug });
+    },
+});
+//# sourceMappingURL=authentik-client.js.map

package/dist/authentik-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik-client.js","sourceRoot":"","sources":["../src/authentik-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAI1C,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAE1B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAElB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACxB,eAAe,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACnD,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,MAAsB,EAAgB,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAI9G,MAAM,MAAM,GAAG,CAAC,MAAoB,EAAU,EAAE,CAAC,WAAW,MAAM,CAAC,MAAM,kBAAkB,MAAM,CAAC,IAAI,GAAG,CAAC;AAC1G,MAAM,UAAU,GAAG,CAAC,MAAoB,EAA2B,EAAE,CAAC,CAAC;IACnE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC,QAAQ;IACzB,YAAY,EAAE,MAAM,CAAC,YAAY;CACpC,CAAC,CAAC;AAOH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,MAAoB,YAAY,EAAY,EAAE,CAAC,CAAC;IAC1F,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5H,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,qBAAqB,GAAG,CAAC,EAAE,gEAAgE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACpH,OAAO,SAAS,CAAC;QACrB,CAAC;IACL,CAAC;IAED,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAChC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACpB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC,YAAY,CAAC;YACnB,OAAO,EAAE,MAAM,CAAC,YAAY;YAC5B,KAAK,EAAE,MAAM,CAAC,cAAc;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,eAAe,EAAE,MAAM,CAAC,eAAe;SAC1C,CAAC,CAAC;QACH,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACrB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC9G,CAAC;CACJ,CAAC,CAAC"}

package/dist/authentik.d.ts

@@ -0,0 +1,4 @@
+import type { Provider } from "@intentic/engine";
+import { type SshExecutor } from "./ssh.js";
+export declare const createAuthentikProvider: (executor?: SshExecutor) => Provider;
+//# sourceMappingURL=authentik.d.ts.map

package/dist/authentik.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik.d.ts","sourceRoot":"","sources":["../src/authentik.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,kBAAkB,CAAC;AAKjE,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,UAAU,CAAC;AAmGzD,eAAO,MAAM,uBAAuB,GAAI,WAAU,WAAyB,KAAG,QAgD5E,CAAC"}

package/dist/authentik.js

@@ -0,0 +1,132 @@
+import { z } from "zod";
+import { composeDown, composeUp, containerImage, stateDir, waitReady } from "./backing-ssh.js";
+import { parseInputs, sshSchema, sshTarget } from "./inputs.js";
+import { sshExecutor } from "./ssh.js";
+const KIND = "authentik";
+const READY_TIMEOUT_MS = 300_000;
+const authentikSchema = sshSchema.extend({
+    internalIp: z.string(),
+    publishPort: z.number(),
+    domain: z.string(),
+    secretKey: z.string(),
+    bootstrapToken: z.string(),
+    bootstrapPassword: z.string(),
+    dbPassword: z.string(),
+    image: z.string(),
+    pgImage: z.string(),
+    redisImage: z.string(),
+});
+const parse = (inputs) => parseInputs(authentikSchema, inputs, KIND);
+const internalUrl = (parsed) => `http://${parsed.internalIp}:${parsed.publishPort}`;
+const outputsFor = (parsed) => ({
+    url: `https://${parsed.domain}`,
+    issuerUrl: `https://${parsed.domain}/application/o/`,
+    internalUrl: internalUrl(parsed),
+});
+const composeYaml = (id, parsed) => [
+    "services:",
+    "  postgresql:",
+    `    image: ${parsed.pgImage}`,
+    "    restart: unless-stopped",
+    "    environment: { POSTGRES_USER: authentik, POSTGRES_DB: authentik, POSTGRES_PASSWORD: $AUTHENTIK_POSTGRESQL__PASSWORD }",
+    "    volumes: [ database:/var/lib/postgresql/data ]",
+    "    healthcheck: { test: [ CMD-SHELL, pg_isready -U authentik ], interval: 10s, timeout: 5s, retries: 10 }",
+    "  redis:",
+    `    image: ${parsed.redisImage}`,
+    "    restart: unless-stopped",
+    '    command: [ "--save", "60", "1", "--loglevel", "warning" ]',
+    "    volumes: [ redis:/data ]",
+    '    healthcheck: { test: [ CMD-SHELL, "valkey-cli ping | grep -q PONG" ], interval: 10s, timeout: 5s, retries: 10 }',
+    "  server:",
+    `    image: ${parsed.image}`,
+    "    restart: unless-stopped",
+    "    command: server",
+    "    env_file: ./.env",
+    `    ports: [ "${parsed.publishPort}:9000" ]`,
+    "    volumes: [ media:/media, templates:/templates ]",
+    "    depends_on: { postgresql: { condition: service_healthy }, redis: { condition: service_healthy } }",
+    `    labels: [ "intentic.id=${id}" ]`,
+    "  worker:",
+    `    image: ${parsed.image}`,
+    "    restart: unless-stopped",
+    "    command: worker",
+    "    env_file: ./.env",
+    "    volumes: [ media:/media, certs:/certs, templates:/templates, /var/run/docker.sock:/var/run/docker.sock ]",
+    "    depends_on: { postgresql: { condition: service_healthy }, redis: { condition: service_healthy } }",
+    "volumes: { database: {}, redis: {}, media: {}, certs: {}, templates: {} }",
+    "",
+].join("\n");
+const ensureFiles = async (session, id, parsed) => {
+    const dir = stateDir(KIND, id);
+    await session.exec(`mkdir -p ${dir}`);
+    await session.exec(`cat > ${dir}/compose.yaml <<'COMPOSE_EOF'\n${composeYaml(id, parsed)}COMPOSE_EOF`);
+    const envLines = [
+        "AUTHENTIK_POSTGRESQL__HOST=postgresql",
+        "AUTHENTIK_POSTGRESQL__USER=authentik",
+        "AUTHENTIK_POSTGRESQL__NAME=authentik",
+        "AUTHENTIK_REDIS__HOST=redis",
+        `AUTHENTIK_BOOTSTRAP_EMAIL=akadmin@${parsed.domain}`,
+        `AUTHENTIK_SECRET_KEY=${parsed.secretKey}`,
+        `AUTHENTIK_POSTGRESQL__PASSWORD=${parsed.dbPassword}`,
+        `AUTHENTIK_BOOTSTRAP_PASSWORD=${parsed.bootstrapPassword}`,
+        `AUTHENTIK_BOOTSTRAP_TOKEN=${parsed.bootstrapToken}`,
+    ]
+        .map((line) => `'${line}'`)
+        .join(" ");
+    await session.exec(`test -f ${dir}/.env || { printf '%s\\n' ${envLines} > ${dir}/.env && chmod 600 ${dir}/.env; }`);
+};
+const readyProbe = (parsed) => `wget -q -O /dev/null ${internalUrl(parsed)}/-/health/ready/`;
+export const createAuthentikProvider = (executor = sshExecutor) => ({
+    read: async (inputs, ctx) => {
+        const parsed = parse(inputs);
+        let session;
+        try {
+            session = await executor.connect(sshTarget(parsed));
+        }
+        catch (error) {
+            ctx.log(`authentik "${ctx.id}": host not reachable over SSH, treating as not-yet-created: ${String(error)}`);
+            return undefined;
+        }
+        try {
+            const probe = await session.exec(readyProbe(parsed));
+            if (probe.code !== 0) {
+                return undefined;
+            }
+            return { outputs: outputsFor(parsed), detail: { image: await containerImage(session, ctx.id) } };
+        }
+        finally {
+            await session.dispose();
+        }
+    },
+    diff: (inputs, observed) => {
+        const parsed = parse(inputs);
+        const image = (observed.detail?.["image"] ?? "");
+        return image === parsed.image
+            ? { action: "noop" }
+            : { action: "update", reason: `authentik image differs (running ${image}, want ${parsed.image})` };
+    },
+    apply: async (inputs, _observed, ctx) => {
+        const parsed = parse(inputs);
+        const session = await executor.connect(sshTarget(parsed));
+        try {
+            await ensureFiles(session, ctx.id, parsed);
+            await composeUp(session, KIND, ctx.id);
+            await waitReady(session, KIND, ctx.id, readyProbe(parsed), READY_TIMEOUT_MS);
+            return outputsFor(parsed);
+        }
+        finally {
+            await session.dispose();
+        }
+    },
+    delete: async (inputs, ctx) => {
+        const parsed = parse(inputs);
+        const session = await executor.connect(sshTarget(parsed));
+        try {
+            await composeDown(session, KIND, ctx.id);
+        }
+        finally {
+            await session.dispose();
+        }
+    },
+});
+//# sourceMappingURL=authentik.js.map

package/dist/authentik.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentik.js","sourceRoot":"","sources":["../src/authentik.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAEhE,OAAO,EAAoB,WAAW,EAAE,MAAM,UAAU,CAAC;AAEzD,MAAM,IAAI,GAAG,WAAW,CAAC;AAEzB,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,CAAC;IACrC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IAEtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE;IACrB,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE;IAC1B,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;CACzB,CAAC,CAAC;AAEH,MAAM,KAAK,GAAG,CAAC,MAAsB,EAAmB,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAEtG,MAAM,WAAW,GAAG,CAAC,MAAuB,EAAU,EAAE,CAAC,UAAU,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;AAC7G,MAAM,UAAU,GAAG,CAAC,MAAuB,EAA2B,EAAE,CAAC,CAAC;IACtE,GAAG,EAAE,WAAW,MAAM,CAAC,MAAM,EAAE;IAC/B,SAAS,EAAE,WAAW,MAAM,CAAC,MAAM,iBAAiB;IACpD,WAAW,EAAE,WAAW,CAAC,MAAM,CAAC;CACnC,CAAC,CAAC;AAMH,MAAM,WAAW,GAAG,CAAC,EAAU,EAAE,MAAuB,EAAU,EAAE,CAChE;IACI,WAAW;IACX,eAAe;IACf,cAAc,MAAM,CAAC,OAAO,EAAE;IAC9B,6BAA6B;IAC7B,2HAA2H;IAC3H,oDAAoD;IACpD,4GAA4G;IAC5G,UAAU;IACV,cAAc,MAAM,CAAC,UAAU,EAAE;IACjC,6BAA6B;IAC7B,+DAA+D;IAC/D,8BAA8B;IAC9B,qHAAqH;IACrH,WAAW;IACX,cAAc,MAAM,CAAC,KAAK,EAAE;IAC5B,6BAA6B;IAC7B,qBAAqB;IACrB,sBAAsB;IACtB,iBAAiB,MAAM,CAAC,WAAW,UAAU;IAC7C,qDAAqD;IACrD,uGAAuG;IACvG,8BAA8B,EAAE,KAAK;IACrC,WAAW;IACX,cAAc,MAAM,CAAC,KAAK,EAAE;IAC5B,6BAA6B;IAC7B,qBAAqB;IACrB,sBAAsB;IACtB,8GAA8G;IAC9G,uGAAuG;IACvG,2EAA2E;IAC3E,EAAE;CACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAKjB,MAAM,WAAW,GAAG,KAAK,EAAE,OAAmB,EAAE,EAAU,EAAE,MAAuB,EAAiB,EAAE;IAClG,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,IAAI,CAAC,SAAS,GAAG,kCAAkC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;IACvG,MAAM,QAAQ,GAAG;QACb,uCAAuC;QACvC,sCAAsC;QACtC,sCAAsC;QACtC,6BAA6B;QAC7B,qCAAqC,MAAM,CAAC,MAAM,EAAE;QACpD,wBAAwB,MAAM,CAAC,SAAS,EAAE;QAC1C,kCAAkC,MAAM,CAAC,UAAU,EAAE;QACrD,gCAAgC,MAAM,CAAC,iBAAiB,EAAE;QAC1D,6BAA6B,MAAM,CAAC,cAAc,EAAE;KACvD;SACI,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;SAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,6BAA6B,QAAQ,MAAM,GAAG,sBAAsB,GAAG,UAAU,CAAC,CAAC;AACxH,CAAC,CAAC;AAIF,MAAM,UAAU,GAAG,CAAC,MAAuB,EAAU,EAAE,CAAC,wBAAwB,WAAW,CAAC,MAAM,CAAC,kBAAkB,CAAC;AAMtH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,WAAwB,WAAW,EAAY,EAAE,CAAC,CAAC;IACvF,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAmB,CAAC;QACxB,IAAI,CAAC;YACD,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,GAAG,CAAC,GAAG,CAAC,cAAc,GAAG,CAAC,EAAE,gEAAgE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7G,OAAO,SAAS,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACnB,OAAO,SAAS,CAAC;YACrB,CAAC;YACD,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACrG,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,IAAI,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE;QACvB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,CAAW,CAAC;QAC3D,OAAO,KAAK,KAAK,MAAM,CAAC,KAAK;YACzB,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE;YACpB,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,oCAAoC,KAAK,UAAU,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;IAC3G,CAAC;IACD,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACD,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3C,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACvC,MAAM,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC7E,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;IACL,CAAC;IACD,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC;YACD,MAAM,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7C,CAAC;gBAAS,CAAC;YACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;QAC5B,CAAC;IACL,CAAC;CACJ,CAAC,CAAC"}

package/dist/backing-ssh.d.ts

@@ -0,0 +1,8 @@
+import type { SshSession } from "./ssh.js";
+export declare const stateDir: (kind: string, id: string) => string;
+export declare const containerId: (session: SshSession, stamp: string) => Promise<string>;
+export declare const containerImage: (session: SshSession, stamp: string) => Promise<string>;
+export declare const composeUp: (session: SshSession, kind: string, id: string) => Promise<void>;
+export declare const composeDown: (session: SshSession, kind: string, id: string) => Promise<void>;
+export declare const waitReady: (session: SshSession, kind: string, id: string, probe: string, timeoutMs: number) => Promise<void>;
+//# sourceMappingURL=backing-ssh.d.ts.map

package/dist/backing-ssh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backing-ssh.d.ts","sourceRoot":"","sources":["../src/backing-ssh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAe3C,eAAO,MAAM,QAAQ,GAAI,MAAM,MAAM,EAAE,IAAI,MAAM,KAAG,MAA6C,CAAC;AAKlG,eAAO,MAAM,WAAW,GAAU,SAAS,UAAU,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAGpF,CAAC;AAIF,eAAO,MAAM,cAAc,GAAU,SAAS,UAAU,EAAE,OAAO,MAAM,KAAG,OAAO,CAAC,MAAM,CAOvF,CAAC;AAGF,eAAO,MAAM,SAAS,GAAU,SAAS,UAAU,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAQ3F,CAAC;AAGF,eAAO,MAAM,WAAW,GAAU,SAAS,UAAU,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,KAAG,OAAO,CAAC,IAAI,CAM7F,CAAC;AAGF,eAAO,MAAM,SAAS,GAAU,SAAS,UAAU,EAAE,MAAM,MAAM,EAAE,IAAI,MAAM,EAAE,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,IAAI,CAY7H,CAAC"}

package/dist/backing-ssh.js

@@ -0,0 +1,44 @@
+const slug = (id) => id
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+export const stateDir = (kind, id) => `/opt/intentic/${kind}/${slug(id)}`;
+const projectName = (kind, id) => `intentic-${kind}-${slug(id)}`;
+export const containerId = async (session, stamp) => {
+    const result = await session.exec(`docker ps -q --filter "label=intentic.id=${stamp}" --format '{{.ID}}'`);
+    return result.stdout.trim().split("\n")[0] ?? "";
+};
+export const containerImage = async (session, stamp) => {
+    const id = await containerId(session, stamp);
+    if (id === "") {
+        return "";
+    }
+    const result = await session.exec(`docker inspect --format '{{.Config.Image}}' ${id}`);
+    return result.stdout.trim();
+};
+export const composeUp = async (session, kind, id) => {
+    const dir = stateDir(kind, id);
+    const up = await session.exec(`docker compose -p ${projectName(kind, id)} --project-directory ${dir} --env-file ${dir}/.env -f ${dir}/compose.yaml up -d`);
+    if (up.code !== 0) {
+        throw new Error(`failed to bring up ${kind} "${id}": exited ${up.code}: ${up.stderr.trim()}`);
+    }
+};
+export const composeDown = async (session, kind, id) => {
+    const dir = stateDir(kind, id);
+    await session.exec(`docker compose -p ${projectName(kind, id)} --project-directory ${dir} --env-file ${dir}/.env -f ${dir}/compose.yaml down -v 2>/dev/null || true`);
+    await session.exec(`rm -rf ${dir}`);
+};
+export const waitReady = async (session, kind, id, probe, timeoutMs) => {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+        const result = await session.exec(probe);
+        if (result.code === 0) {
+            return;
+        }
+        if (Date.now() >= deadline) {
+            throw new Error(`${kind} "${id}" did not become ready within ${timeoutMs}ms`);
+        }
+        await new Promise((resolve) => setTimeout(resolve, 3_000));
+    }
+};
+//# sourceMappingURL=backing-ssh.js.map

package/dist/backing-ssh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backing-ssh.js","sourceRoot":"","sources":["../src/backing-ssh.ts"],"names":[],"mappings":"AAQA,MAAM,IAAI,GAAG,CAAC,EAAU,EAAU,EAAE,CAChC,EAAE;KACG,WAAW,EAAE;KACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAGjC,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAE,EAAU,EAAU,EAAE,CAAC,iBAAiB,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAClG,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAU,EAAU,EAAE,CAAC,YAAY,IAAI,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AAIzF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAmB,EAAE,KAAa,EAAmB,EAAE;IACrF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,4CAA4C,KAAK,sBAAsB,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACrD,CAAC,CAAC;AAIF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,OAAmB,EAAE,KAAa,EAAmB,EAAE;IACxF,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC7C,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,CAAC,CAAC;IACvF,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAChC,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,OAAmB,EAAE,IAAY,EAAE,EAAU,EAAiB,EAAE;IAC5F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,IAAI,CACzB,qBAAqB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,GAAG,eAAe,GAAG,YAAY,GAAG,qBAAqB,CAC9H,CAAC;IACF,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,KAAK,EAAE,aAAa,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;AACL,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,WAAW,GAAG,KAAK,EAAE,OAAmB,EAAE,IAAY,EAAE,EAAU,EAAiB,EAAE;IAC9F,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,MAAM,OAAO,CAAC,IAAI,CACd,qBAAqB,WAAW,CAAC,IAAI,EAAE,EAAE,CAAC,wBAAwB,GAAG,eAAe,GAAG,YAAY,GAAG,2CAA2C,CACpJ,CAAC;IACF,MAAM,OAAO,CAAC,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;AACxC,CAAC,CAAC;AAGF,MAAM,CAAC,MAAM,SAAS,GAAG,KAAK,EAAE,OAAmB,EAAE,IAAY,EAAE,EAAU,EAAE,KAAa,EAAE,SAAiB,EAAiB,EAAE;IAC9H,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,SAAS,CAAC;QACN,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO;QACX,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,EAAE,iCAAiC,SAAS,IAAI,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/D,CAAC;AACL,CAAC,CAAC"}

package/dist/backup-restore.d.ts

@@ -0,0 +1,15 @@
+import type { SshExecutor, SshTarget } from "./ssh.js";
+export type RestoreScope = "forgejo" | "komodo" | "all";
+export interface RestoreArgs {
+    readonly target: SshTarget;
+    readonly image: string;
+    readonly repo: string;
+    readonly password: string;
+    readonly credentials?: Record<string, string>;
+    readonly snapshot: string;
+    readonly scope: RestoreScope;
+    readonly log: (message: string) => void;
+    readonly executor?: SshExecutor;
+}
+export declare const restoreBackup: (args: RestoreArgs) => Promise<void>;
+//# sourceMappingURL=backup-restore.d.ts.map

package/dist/backup-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore.d.ts","sourceRoot":"","sources":["../src/backup-restore.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAc,SAAS,EAAE,MAAM,UAAU,CAAC;AAMnE,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,KAAK,CAAC;AAExD,MAAM,WAAW,WAAW;IACxB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAC;CACnC;AA2BD,eAAO,MAAM,aAAa,GAAU,MAAM,WAAW,KAAG,OAAO,CAAC,IAAI,CA2CnE,CAAC"}

package/dist/backup-restore.js

@@ -0,0 +1,49 @@
+import { sshExecutor } from "./ssh.js";
+const RESTORE_VOLUME = "intentic-restore";
+const resticPrefix = (args) => {
+    const creds = Object.entries(args.credentials ?? {})
+        .map(([key, value]) => `-e ${key}='${value}'`)
+        .join(" ");
+    return `docker run --rm -e RESTIC_PASSWORD='${args.password}' ${creds} -v ${RESTORE_VOLUME}:/restore ${args.image} -r '${args.repo}'`;
+};
+const restoreVolume = (args, volume, sub) => `docker run --rm --entrypoint sh -v ${volume}:/dest -v ${RESTORE_VOLUME}:/restore ${args.image} ` +
+    `-c 'rm -rf /dest/..?* /dest/.[!.]* /dest/* 2>/dev/null; cp -a /restore/volumes/${sub}/. /dest/'`;
+const wants = (scope, part) => scope === "all" || scope === part;
+export const restoreBackup = async (args) => {
+    const executor = args.executor ?? sshExecutor;
+    const session = await executor.connect(args.target);
+    const run = async (command, what) => {
+        const result = await session.exec(command);
+        if (result.code !== 0) {
+            throw new Error(`restore: ${what} failed (exit ${result.code}): ${result.stderr.trim()}`);
+        }
+    };
+    try {
+        args.log(`restoring snapshot "${args.snapshot}" (${args.scope}) from ${args.repo}`);
+        await run(`docker volume create ${RESTORE_VOLUME}`, "create restore volume");
+        await run(`${resticPrefix(args)} restore '${args.snapshot}' --target /restore`, "restic restore");
+        if (wants(args.scope, "forgejo")) {
+            await session.exec("docker rm -f intentic-forgejo intentic-forgejo-runner 2>/dev/null || true");
+            await run(restoreVolume(args, "intentic-forgejo-data", "forgejo"), "restore forgejo volume");
+            args.log("restored Forgejo data volume");
+        }
+        if (wants(args.scope, "komodo")) {
+            await session.exec('ids=$(docker ps -aq -f label=com.docker.compose.project=komodo); [ -n "$ids" ] && docker rm -f $ids || true');
+            await run(restoreVolume(args, "komodo_postgres-data", "komodo-postgres"), "restore komodo postgres volume");
+            await run(restoreVolume(args, "komodo_keys", "komodo-keys"), "restore komodo keys volume");
+            await run(restoreVolume(args, "komodo_ferretdb-state", "komodo-ferretdb"), "restore komodo ferretdb volume");
+            args.log("restored Komodo data volumes");
+        }
+        if (args.scope === "all") {
+            await run(`docker run --rm --entrypoint sh -v /opt/intentic:/dest -v ${RESTORE_VOLUME}:/restore ${args.image} ` +
+                "-c 'cp -a /restore/host-opt-intentic/. /dest/'", "restore /opt/intentic state");
+            args.log("restored /opt/intentic host state");
+        }
+        await session.exec(`docker volume rm ${RESTORE_VOLUME} 2>/dev/null || true`);
+        args.log('restore complete — run "intentic apply" to bring the services back up on the restored data');
+    }
+    finally {
+        await session.dispose();
+    }
+};
+//# sourceMappingURL=backup-restore.js.map

package/dist/backup-restore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-restore.js","sourceRoot":"","sources":["../src/backup-restore.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAoBvC,MAAM,cAAc,GAAG,kBAAkB,CAAC;AAI1C,MAAM,YAAY,GAAG,CAAC,IAAiB,EAAU,EAAE;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,GAAG,KAAK,KAAK,GAAG,CAAC;SAC7C,IAAI,CAAC,GAAG,CAAC,CAAC;IACf,OAAO,uCAAuC,IAAI,CAAC,QAAQ,KAAK,KAAK,OAAO,cAAc,aAAa,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,IAAI,GAAG,CAAC;AAC1I,CAAC,CAAC;AAIF,MAAM,aAAa,GAAG,CAAC,IAAiB,EAAE,MAAc,EAAE,GAAW,EAAU,EAAE,CAC7E,sCAAsC,MAAM,aAAa,cAAc,aAAa,IAAI,CAAC,KAAK,GAAG;IACjG,kFAAkF,GAAG,YAAY,CAAC;AAEtG,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAE,IAA0B,EAAW,EAAE,CAAC,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC;AAO9G,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,IAAiB,EAAiB,EAAE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC;IAC9C,MAAM,OAAO,GAAe,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,KAAK,EAAE,OAAe,EAAE,IAAY,EAAiB,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,YAAY,IAAI,iBAAiB,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;IACL,CAAC,CAAC;IACF,IAAI,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,uBAAuB,IAAI,CAAC,QAAQ,MAAM,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,MAAM,GAAG,CAAC,wBAAwB,cAAc,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC7E,MAAM,GAAG,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,qBAAqB,EAAE,gBAAgB,CAAC,CAAC;QAElG,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,SAAS,CAAC,EAAE,CAAC;YAE/B,MAAM,OAAO,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;YAChG,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,uBAAuB,EAAE,SAAS,CAAC,EAAE,wBAAwB,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,EAAE,CAAC;YAE9B,MAAM,OAAO,CAAC,IAAI,CAAC,6GAA6G,CAAC,CAAC;YAClI,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,sBAAsB,EAAE,iBAAiB,CAAC,EAAE,gCAAgC,CAAC,CAAC;YAC5G,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,4BAA4B,CAAC,CAAC;YAC3F,MAAM,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,uBAAuB,EAAE,iBAAiB,CAAC,EAAE,gCAAgC,CAAC,CAAC;YAC7G,IAAI,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAEvB,MAAM,GAAG,CACL,6DAA6D,cAAc,aAAa,IAAI,CAAC,KAAK,GAAG;gBACjG,gDAAgD,EACpD,6BAA6B,CAChC,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QAClD,CAAC;QAED,MAAM,OAAO,CAAC,IAAI,CAAC,oBAAoB,cAAc,sBAAsB,CAAC,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,4FAA4F,CAAC,CAAC;IAC3G,CAAC;YAAS,CAAC;QACP,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5B,CAAC;AACL,CAAC,CAAC"}

package/dist/backup.d.ts

@@ -0,0 +1,4 @@
+import type { Provider } from "@intentic/engine";
+import type { SshExecutor } from "./ssh.js";
+export declare const createBackupProvider: (executor?: SshExecutor) => Provider;
+//# sourceMappingURL=backup.d.ts.map

package/dist/backup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup.d.ts","sourceRoot":"","sources":["../src/backup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAkB,MAAM,kBAAkB,CAAC;AAGjE,OAAO,KAAK,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AAkHxD,eAAO,MAAM,oBAAoB,GAAI,WAAU,WAAyB,KAAG,QAwEzE,CAAC"}