@lifeaitools/clauth 1.31.1 → 2.0.1

package/cli/commands/uninstall.js

@@ -1,164 +1,164 @@
-// cli/commands/uninstall.js
-// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
-//
-// Reverses everything `clauth install` does:
-//   1. Drops clauth tables, policies, triggers, functions from Supabase
-//   2. Deletes auth-vault Edge Function
-//   3. Removes CLAUTH_* secrets
-//   4. Removes Claude skill directory
-//   5. Clears local config (Conf store)
-
-import { existsSync, rmSync } from 'fs';
-import { join } from 'path';
-import Conf from 'conf';
-import chalk from 'chalk';
-import ora from 'ora';
-
-const MGMT = 'https://api.supabase.com/v1';
-const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
-  (process.platform === 'win32'
-    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
-    : join(process.env.HOME || '', '.claude', 'skills'));
-
-// ─────────────────────────────────────────────
-// Supabase Management API helper
-// ─────────────────────────────────────────────
-async function mgmt(pat, method, path, body) {
-  const res = await fetch(`${MGMT}${path}`, {
-    method,
-    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-    body: body ? JSON.stringify(body) : undefined,
-  });
-  if (!res.ok) {
-    const text = await res.text().catch(() => res.statusText);
-    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
-  }
-  if (res.status === 204) return {};
-  const text = await res.text();
-  if (!text) return {};
-  return JSON.parse(text);
-}
-
-// ─────────────────────────────────────────────
-// Main uninstall command
-// ─────────────────────────────────────────────
-export async function runUninstall(opts = {}) {
-  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
-
-  const config = new Conf({ projectName: 'clauth' });
-
-  // ── Collect credentials ────────────────────
-  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
-  const pat = opts.pat;
-
-  if (!ref) {
-    console.log(chalk.red('  Cannot determine Supabase project ref.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-  if (!pat) {
-    console.log(chalk.red('  Supabase PAT required for teardown.'));
-    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
-    process.exit(1);
-  }
-
-  console.log(chalk.gray(`  Project: ${ref}\n`));
-
-  // ── Step 1: Drop database objects ──────────
-  const s1 = ora('Dropping clauth database objects...').start();
-  const teardownSQL = `
-    -- Drop triggers
-    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
-
-    -- Drop tables (CASCADE drops policies automatically)
-    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
-    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
-    DROP TABLE IF EXISTS public.clauth_services CASCADE;
-
-    -- Drop functions
-    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
-    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
-  `;
-
-  try {
-    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
-    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
-  } catch (e) {
-    s1.fail(`Database teardown failed: ${e.message}`);
-    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
-  }
-
-  // ── Step 2: Delete Edge Function ───────────
-  const s2 = ora('Deleting auth-vault Edge Function...').start();
-  try {
-    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}` },
-    });
-    if (res.ok || res.status === 404) {
-      s2.succeed(res.status === 404
-        ? 'Edge Function not found (already deleted)'
-        : 'Edge Function deleted');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s2.fail(`Edge Function delete failed: ${e.message}`);
-    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
-  }
-
-  // ── Step 3: Remove secrets ─────────────────
-  const s3 = ora('Removing clauth secrets...').start();
-  try {
-    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
-    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
-      method: 'DELETE',
-      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
-      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
-    });
-    if (res.ok) {
-      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
-    } else {
-      const text = await res.text().catch(() => res.statusText);
-      throw new Error(`HTTP ${res.status}: ${text}`);
-    }
-  } catch (e) {
-    s3.warn(`Secret removal failed: ${e.message}`);
-    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
-  }
-
-  // ── Step 4: Remove Claude skill ────────────
-  const s4 = ora('Removing Claude skill...').start();
-  const skillDir = join(SKILLS_DIR, 'clauth');
-  if (existsSync(skillDir)) {
-    try {
-      rmSync(skillDir, { recursive: true, force: true });
-      s4.succeed(`Skill removed: ${skillDir}`);
-    } catch (e) {
-      s4.warn(`Could not remove skill: ${e.message}`);
-    }
-  } else {
-    s4.succeed('Skill directory not found (already removed)');
-  }
-
-  // ── Step 5: Clear local config ─────────────
-  const s5 = ora('Clearing local config...').start();
-  try {
-    config.clear();
-    s5.succeed('Local config cleared');
-  } catch (e) {
-    s5.warn(`Could not clear config: ${e.message}`);
-  }
-
-  // ── Done ───────────────────────────────────
-  console.log('');
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
-  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
-  console.log('');
-  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
-  console.log('');
-}
+// cli/commands/uninstall.js
+// clauth uninstall — full teardown: DB objects, Edge Function, secrets, skill, local config
+//
+// Reverses everything `clauth install` does:
+//   1. Drops clauth tables, policies, triggers, functions from Supabase
+//   2. Deletes auth-vault Edge Function
+//   3. Removes CLAUTH_* secrets
+//   4. Removes Claude skill directory
+//   5. Clears local config (Conf store)
+
+import { existsSync, rmSync } from 'fs';
+import { join } from 'path';
+import Conf from 'conf';
+import chalk from 'chalk';
+import ora from 'ora';
+
+const MGMT = 'https://api.supabase.com/v1';
+const SKILLS_DIR = process.env.CLAUTH_SKILLS_DIR ||
+  (process.platform === 'win32'
+    ? join(process.env.USERPROFILE || '', '.claude', 'skills')
+    : join(process.env.HOME || '', '.claude', 'skills'));
+
+// ─────────────────────────────────────────────
+// Supabase Management API helper
+// ─────────────────────────────────────────────
+async function mgmt(pat, method, path, body) {
+  const res = await fetch(`${MGMT}${path}`, {
+    method,
+    headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+    body: body ? JSON.stringify(body) : undefined,
+  });
+  if (!res.ok) {
+    const text = await res.text().catch(() => res.statusText);
+    throw new Error(`${method} ${path} → HTTP ${res.status}: ${text}`);
+  }
+  if (res.status === 204) return {};
+  const text = await res.text();
+  if (!text) return {};
+  return JSON.parse(text);
+}
+
+// ─────────────────────────────────────────────
+// Main uninstall command
+// ─────────────────────────────────────────────
+export async function runUninstall(opts = {}) {
+  console.log(chalk.red('\n🗑️  clauth uninstall\n'));
+
+  const config = new Conf({ projectName: 'clauth' });
+
+  // ── Collect credentials ────────────────────
+  const ref = opts.ref || config.get('supabase_url')?.match(/https:\/\/(.+)\.supabase\.co/)?.[1];
+  const pat = opts.pat;
+
+  if (!ref) {
+    console.log(chalk.red('  Cannot determine Supabase project ref.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+  if (!pat) {
+    console.log(chalk.red('  Supabase PAT required for teardown.'));
+    console.log(chalk.gray('  Use: clauth uninstall --ref <project-ref> --pat <personal-access-token>'));
+    process.exit(1);
+  }
+
+  console.log(chalk.gray(`  Project: ${ref}\n`));
+
+  // ── Step 1: Drop database objects ──────────
+  const s1 = ora('Dropping clauth database objects...').start();
+  const teardownSQL = `
+    -- Drop triggers
+    DROP TRIGGER IF EXISTS clauth_services_updated ON public.clauth_services;
+
+    -- Drop tables (CASCADE drops policies automatically)
+    DROP TABLE IF EXISTS public.clauth_audit CASCADE;
+    DROP TABLE IF EXISTS public.clauth_machines CASCADE;
+    DROP TABLE IF EXISTS public.clauth_services CASCADE;
+
+    -- Drop functions
+    DROP FUNCTION IF EXISTS public.clauth_touch_updated() CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_upsert_vault_secret(text, text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_get_vault_secret(text) CASCADE;
+    DROP FUNCTION IF EXISTS public.clauth_delete_vault_secret(text) CASCADE;
+  `;
+
+  try {
+    await mgmt(pat, 'POST', `/projects/${ref}/database/query`, { query: teardownSQL });
+    s1.succeed('Database objects dropped (tables, triggers, functions, policies)');
+  } catch (e) {
+    s1.fail(`Database teardown failed: ${e.message}`);
+    console.log(chalk.yellow('  You may need to drop objects manually via SQL editor.'));
+  }
+
+  // ── Step 2: Delete Edge Function ───────────
+  const s2 = ora('Deleting auth-vault Edge Function...').start();
+  try {
+    const res = await fetch(`${MGMT}/projects/${ref}/functions/auth-vault`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}` },
+    });
+    if (res.ok || res.status === 404) {
+      s2.succeed(res.status === 404
+        ? 'Edge Function not found (already deleted)'
+        : 'Edge Function deleted');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s2.fail(`Edge Function delete failed: ${e.message}`);
+    console.log(chalk.yellow('  Delete manually: Supabase Dashboard → Edge Functions → auth-vault → Delete'));
+  }
+
+  // ── Step 3: Remove secrets ─────────────────
+  const s3 = ora('Removing clauth secrets...').start();
+  try {
+    // Supabase Management API: DELETE /projects/{ref}/secrets with body listing secret names
+    const res = await fetch(`${MGMT}/projects/${ref}/secrets`, {
+      method: 'DELETE',
+      headers: { 'Authorization': `Bearer ${pat}`, 'Content-Type': 'application/json' },
+      body: JSON.stringify(['CLAUTH_HMAC_SALT', 'CLAUTH_ADMIN_BOOTSTRAP_TOKEN']),
+    });
+    if (res.ok) {
+      s3.succeed('Secrets removed (CLAUTH_HMAC_SALT, CLAUTH_ADMIN_BOOTSTRAP_TOKEN)');
+    } else {
+      const text = await res.text().catch(() => res.statusText);
+      throw new Error(`HTTP ${res.status}: ${text}`);
+    }
+  } catch (e) {
+    s3.warn(`Secret removal failed: ${e.message}`);
+    console.log(chalk.yellow('  Remove manually: Supabase → Settings → Edge Functions → Secrets'));
+  }
+
+  // ── Step 4: Remove Claude skill ────────────
+  const s4 = ora('Removing Claude skill...').start();
+  const skillDir = join(SKILLS_DIR, 'clauth');
+  if (existsSync(skillDir)) {
+    try {
+      rmSync(skillDir, { recursive: true, force: true });
+      s4.succeed(`Skill removed: ${skillDir}`);
+    } catch (e) {
+      s4.warn(`Could not remove skill: ${e.message}`);
+    }
+  } else {
+    s4.succeed('Skill directory not found (already removed)');
+  }
+
+  // ── Step 5: Clear local config ─────────────
+  const s5 = ora('Clearing local config...').start();
+  try {
+    config.clear();
+    s5.succeed('Local config cleared');
+  } catch (e) {
+    s5.warn(`Could not clear config: ${e.message}`);
+  }
+
+  // ── Done ───────────────────────────────────
+  console.log('');
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log(chalk.yellow('  ✓ clauth fully uninstalled'));
+  console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
+  console.log('');
+  console.log(chalk.gray('  To reinstall: npx @lifeaitools/clauth install'));
+  console.log('');
+}

package/cli/commands/watchdog.js

@@ -131,7 +131,7 @@ export async function runWatchdog(action, opts = {}) {
       console.log("Usage: clauth watchdog restart <service-id>");
       return;
     }
-    const result = restartWatchdogService(serviceId);
+    const result = await restartWatchdogService(serviceId);
     console.log(JSON.stringify(result, null, 2));
     return;
   }

package/cli/index.js

@@ -149,7 +149,10 @@ program
 import { runInstall } from './commands/install.js';
 import { runUninstall } from './commands/uninstall.js';
 import { runScrub } from './commands/scrub.js';
-import { runServe } from './commands/serve.js';
+import { runServe, MCP_TOOLS } from './commands/serve.js';
+import { deregisterPlugin, listPlugins, registerPlugin, syncPluginsFromRepos, SYNC_REPO_NAMES, SYNC_SKIP_STATES } from './supervisor-registry.js';
+import { runOps } from './commands/ops.js';
+import { runOpsInstall } from './commands/ops-install.js';
 import { runCodevelop } from './commands/codevelop.js';
 import { runNpm, runPublish } from './commands/npm.js';
 import { runLogin } from './commands/login.js';
@@ -960,6 +963,149 @@ tunnelCmd
     }
   });
 
+// ──────────────────────────────────────────────
+// clauth mcp list
+// ──────────────────────────────────────────────
+// Known MCP-server plugin ids in the managed fleet. Positive allowlist
+// rather than a naming heuristic (credential-name conventions and health
+// route "kind" vary across these) — dev-center and any future non-MCP
+// pm2-managed surface stay excluded by construction. Deliberately distinct
+// from `clauth list` (vault credential services); this never touches those.
+const MCP_SERVER_PLUGIN_IDS = new Set([
+  "fs-mcp",
+  "web-research",
+  "regen-media",
+  "regen-media-local",
+  "codeflow-mcp",
+  "rdc-skills",
+]);
+
+const mcpCmd = program.command("mcp").description("Inspect clauth's own MCP tool catalog and managed MCP-server surfaces");
+
+mcpCmd
+  .command("list")
+  .description("List clauth's advertised MCP tools and MCP-server surfaces (never vault credential services)")
+  .action(() => {
+    console.log(chalk.cyan(`\n  clauth's own MCP tools (${MCP_TOOLS.length}):\n`));
+    for (const tool of MCP_TOOLS) {
+      console.log(`  ${chalk.white(tool.name)}  ${chalk.gray(tool.description || "")}`);
+    }
+    const mcpPlugins = listPlugins().filter((p) => MCP_SERVER_PLUGIN_IDS.has(p.id));
+    console.log(chalk.cyan(`\n  Managed MCP-server surfaces (${mcpPlugins.length}):\n`));
+    if (!mcpPlugins.length) {
+      console.log(chalk.gray("  none discovered — is the daemon running? clauth serve"));
+    }
+    for (const plugin of mcpPlugins) {
+      const state = plugin.enabled ? plugin.state : "disabled";
+      const icon = state === "current" ? "✓" : state === "disabled" ? "○" : "⚠";
+      console.log(`  ${icon} ${chalk.white(plugin.id)}  ${chalk.gray(state)}`);
+      for (const surface of plugin.surfaces || []) {
+        console.log(`      ${surface.id}  ${chalk.gray(surface.health || surface.routes?.[0]?.url || "no health route")}`);
+      }
+    }
+    console.log("");
+  });
+
+// ──────────────────────────────────────────────
+// clauth plugin register <manifest-path>
+// The self-registration entry point for PLUGIN-ARCHITECTURE-DECISION.md:
+// a product repo's own install/deploy step calls this after its
+// clauth-plugin.json is in place — same role as clauth's own
+// scripts/postinstall.js, for repos that have no npm-install lifecycle
+// hook of their own (monorepo workspace members, not standalone packages).
+// ──────────────────────────────────────────────
+const pluginCmd = program.command('plugin').description("Register and manage clauth-supervised plugin manifests");
+
+pluginCmd
+  .command('register <manifestPath>')
+  .description('Validate a clauth-plugin.json and register it with the local supervisor, then run discovery')
+  .action((manifestPath) => {
+    const resolved = path.resolve(process.cwd(), manifestPath);
+    const receipt = registerPlugin(resolved, 'cli');
+    const ok = receipt.resulting_state?.ok;
+    const state = receipt.resulting_state?.state;
+    if (!ok) {
+      const pluginState = receipt.resulting_state?.plugin_state;
+      const detail = receipt.resulting_state?.error || (pluginState ? `plugin_state=${pluginState}` : 'registration failed');
+      console.error(`  ✗ ${state}: ${detail}`);
+      process.exitCode = 1;
+      return;
+    }
+    console.log(`  ✓ ${chalk.white(receipt.target?.plugin_id || '?')} ${state} — surfaces: ${(receipt.resulting_state?.surfaces || []).join(', ') || 'none'}`);
+  });
+
+// clauth plugin sync — a SWEEP, NOT A CATALOG. It reads the ORIGINAL
+// clauth-plugin.json in each product repo; it stores no inventory of what
+// exists. See the comment above syncPluginsFromRepos in supervisor-registry.js
+// for why re-consolidating this into a catalog file undoes a deliberate change.
+pluginCmd
+  .command('sync')
+  .description('Sweep the known product-repo clauth-plugin.json manifests and register each one. Reads the ORIGINAL manifest in each repo — stores no catalog, no inventory, no manifest copy, no port assignments. A missing repo or manifest warns and continues.')
+  .option(
+    '--repo-root <path>',
+    `Override a product-repo root as <path> (applies to regen-root) or <name>=<path> where <name> is one of: ${SYNC_REPO_NAMES.join(', ')}. Repeatable.`,
+    (value, previous) => [...(previous || []), value],
+    [],
+  )
+  .action((opts) => {
+    const repoRoots = {};
+    for (const entry of opts.repoRoot || []) {
+      const match = /^([a-zA-Z0-9_.-]+)=(.+)$/.exec(entry);
+      if (match) repoRoots[match[1]] = match[2];
+      else repoRoots['regen-root'] = entry;
+    }
+    let receipts = [];
+    let threw = null;
+    try {
+      receipts = syncPluginsFromRepos(repoRoots, 'cli');
+    } catch (error) {
+      // syncPluginsFromRepos is contracted not to throw; if it ever does, still
+      // print whatever the operator needs rather than a raw Node stack.
+      threw = error;
+    }
+    const skipped = new Set(SYNC_SKIP_STATES);
+    let failures = 0;
+    for (const receipt of receipts) {
+      if (receipt.ok) {
+        console.log(`  ✓ ${chalk.white(receipt.id || '?')} ${receipt.state} — ${chalk.gray(receipt.path || receipt.repo)}`);
+      } else if (skipped.has(receipt.state)) {
+        console.warn(`  ⚠ ${receipt.state}: ${chalk.gray(receipt.path || receipt.repo)}`);
+      } else {
+        failures += 1;
+        console.error(`  ✗ ${receipt.state}: ${receipt.error || receipt.path || receipt.repo}`);
+      }
+    }
+    if (threw) {
+      console.error(`  ✗ sync_failed: ${threw instanceof Error ? threw.message : String(threw)}`);
+      failures += 1;
+    }
+    if (failures > 0) process.exitCode = 1;
+  });
+
+pluginCmd
+  .command('deregister <id>')
+  .description('Remove one managed plugin directory by id and re-run discovery. Removing an unregistered id is a safe no-op.')
+  .option('--dry-run', 'Resolve and print the directory that would be deleted, without deleting it')
+  .action((id, opts) => {
+    let receipt;
+    try {
+      receipt = deregisterPlugin(id, 'cli', { dryRun: Boolean(opts.dryRun) });
+    } catch (error) {
+      console.error(`  ✗ deregister_failed: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = 1;
+      return;
+    }
+    const ok = receipt.resulting_state?.ok;
+    const state = receipt.resulting_state?.state;
+    if (!ok) {
+      console.error(`  ✗ ${state}: ${receipt.resulting_state?.error || 'deregistration failed'}`);
+      process.exitCode = 1;
+      return;
+    }
+    const target = receipt.resulting_state?.target_dir;
+    console.log(`  ✓ ${chalk.white(receipt.target?.plugin_id || '?')} ${state} — surfaces: ${(receipt.resulting_state?.surfaces || []).join(', ') || 'none'}${target ? ` — ${chalk.gray(target)}` : ''}`);
+  });
+
 // ──────────────────────────────────────────────
 // clauth chitchat --session <id>
 // ──────────────────────────────────────────────
@@ -1079,4 +1225,22 @@ Examples:
     await runServe({ ...opts, action: resolvedAction });
   });
 
+program
+  .command("ops <action>")
+  .description("Call the bearer-authenticated PM2 and Coolify operations control plane")
+  .option("--endpoint <url>", "HTTPS control-plane endpoint (or CLAUTH_OPS_ENDPOINT)")
+  .option("--target <name>", "PM2 process name or id")
+  .option("--script <path>", "PM2 script path for start")
+  .option("--instances <n>", "PM2 scale target")
+  .option("--operation <name>", "PM2 operation for run")
+  .option("--args-json <json>", "JSON positional arguments for a raw pm2_* operation")
+  .option("--options-json <json>", "JSON PM2 options for a typed operation")
+  .option("--application <uuid>", "registered Coolify application UUID for promote")
+  .option("--ref <name>", "registered Git ref for deploy")
+  .option("--job <id>", "job id for status lookup")
+  .option("--config <path>", "server-side JSON policy for ops install")
+  .option("--dry-run", "validate and print ops install configuration without changing PM2")
+  .addHelpText("after", `\nActions: catalog | list | describe | run | deploy | promote | job | install\n\nInstall: clauth ops install --config /etc/clauth/ops-control-plane.json\nThe installer creates or updates a PM2-managed local control plane, then proves /health and the bearer gate without reading a token.\n\nThe bearer is retrieved only from local clauth service vultr-ops-api-token and is never printed.\n`)
+  .action(async (action, opts) => { if (action === "install") await runOpsInstall(opts); else await runOps(action, opts); });
+
 program.parse(process.argv);

package/cli/ops/coolify-adapter.js

@@ -0,0 +1,80 @@
+const TERMINAL = new Map([
+  ["finished", "succeeded"], ["success", "succeeded"], ["successful", "succeeded"],
+  ["failed", "failed"], ["error", "failed"], ["cancelled", "failed"],
+]);
+
+function required(value, name) {
+  if (!value) throw new Error(`${name} is required`);
+  return value;
+}
+
+export function normalizeCoolifyState(value) {
+  const raw = String(value || "unknown").toLowerCase();
+  return TERMINAL.get(raw) || (raw.includes("progress") || raw.includes("queue") || raw.includes("running") ? "running" : "unknown");
+}
+
+/**
+ * Extract the deployment UUID from a Coolify deploy response.
+ *
+ * Coolify's `/api/v1/deploy` does NOT return the UUID at the top level — it
+ * answers with a `deployments` ARRAY:
+ *
+ *   { "deployments": [ { "message": "...", "resource_uuid": "...",
+ *                        "deployment_uuid": "ha9xjqcldy7duf2diyjdc20p" } ] }
+ *
+ * Reading only `body.deployment_uuid` therefore yields undefined, the caller
+ * concludes the promotion never started, and the job is marked failed — while
+ * Coolify is in fact building. That happened on a real life.ai promote:
+ * deployment ha9xjqcldy7duf2diyjdc20p was created at the same second the job
+ * reported failure. A failed job invites a retry, so the bug turns one
+ * production deploy into several.
+ *
+ * Accepts the array shape first, then the flat shapes, so a future/simplified
+ * response still resolves.
+ */
+export function deploymentUuidFrom(body) {
+  if (!body || typeof body !== "object") return null;
+  const list = Array.isArray(body.deployments) ? body.deployments : [];
+  for (const entry of list) {
+    if (!entry || typeof entry !== "object") continue;
+    const nested = entry.deployment_uuid || entry.uuid || entry.id;
+    if (typeof nested === "string" && nested) return nested;
+  }
+  const flat = body.deployment_uuid || body.uuid || body.id;
+  return typeof flat === "string" && flat ? flat : null;
+}
+
+export function createCoolifyAdapter({ baseUrl, getToken, fetchImpl = globalThis.fetch } = {}) {
+  const api = String(required(baseUrl, "baseUrl")).replace(/\/$/, "");
+  if (typeof getToken !== "function") throw new Error("getToken is required");
+  async function request(path, options = {}) {
+    const token = await getToken();
+    if (!token) throw new Error("coolify credential unavailable");
+    const headers = new Headers(options.headers || {});
+    headers.set("Accept", "application/json");
+    headers.set("Authorization", `Bearer ${token}`);
+    const response = await fetchImpl(`${api}${path}`, {
+      ...options,
+      headers,
+    });
+    if (!response.ok) throw new Error(`Coolify HTTP ${response.status}`);
+    return response.json();
+  }
+  return {
+    inspect(applicationUuid) { return request(`/api/v1/applications/${encodeURIComponent(required(applicationUuid, "applicationUuid"))}`); },
+    async promote(applicationUuid, options = {}) {
+      const uuid = encodeURIComponent(required(applicationUuid, "applicationUuid"));
+      return request(`/api/v1/deploy?uuid=${uuid}&force=true`, options);
+    },
+    async deployment(deploymentUuid) { return request(`/api/v1/deployments/${encodeURIComponent(required(deploymentUuid, "deploymentUuid"))}`); },
+    async poll(deploymentUuid, { attempts = 30, delay = async () => {} } = {}) {
+      for (let attempt = 1; attempt <= attempts; attempt++) {
+        const deployment = await this.deployment(deploymentUuid);
+        const state = normalizeCoolifyState(deployment.status || deployment.state);
+        if (state === "succeeded" || state === "failed") return { state, deployment, attempts: attempt };
+        await delay(attempt);
+      }
+      return { state: "timed_out", deployment: null, attempts };
+    },
+  };
+}