@mriekki/project-forge 4.8.1 → 4.10.0

package/assets/generated/deployment/src/project_forge_deployment/teardown.py

@@ -3,12 +3,23 @@
 from __future__ import annotations
 
 import json
+import os
 import re
 import shlex
 import shutil
 import subprocess
 from typing import Any, Iterable
 
+from .app_runtime import app_inventory
+from .box_platform import platform_status
+from .cloudflare_ingress import (
+    CLOUDFLARE_API_TOKEN_ENV,
+    PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
+    apply_public_route_removal,
+    cloudflare_ingress_status,
+    cloudflare_route_inventory,
+    plan_public_route_removal,
+)
 from .errors import DeploymentKitError
 from .profiles import load_profile
 from .route_registry import apply_route_change, plan_route_removal, route_inventory
@@ -60,6 +71,24 @@ def parse_environment_targets(items: Iterable[str]) -> dict[str, str]:
     return dict(sorted(result.items()))
 
 
+def parse_environment_scopes(items: Iterable[str]) -> dict[str, str]:
+    result: dict[str, str] = {}
+    for item in items:
+        if not isinstance(item, str) or "=" not in item:
+            raise DeploymentKitError("public-ingress scope bindings must use environment=scope form.")
+        environment, scope = item.split("=", 1)
+        environment = _slug(environment, "environment")
+        if environment in RESERVED_SCOPES:
+            raise DeploymentKitError(f"{environment!r} is reserved and cannot be a remote environment name.")
+        scope = _slug(scope, "public ingress scope")
+        if scope in RESERVED_SCOPES:
+            raise DeploymentKitError(f"{scope!r} is reserved and cannot be a public ingress scope.")
+        if environment in result:
+            raise DeploymentKitError(f"Duplicate public-ingress scope binding: {environment}")
+        result[environment] = scope
+    return dict(sorted(result.items()))
+
+
 def _normalize_production_environments(items: Iterable[str]) -> set[str]:
     result = {"production"}
     for item in items:
@@ -78,6 +107,7 @@ def normalize_teardown_spec(
     environment_targets: dict[str, str] | Iterable[tuple[str, str]],
     local_package: str | None,
     production_environments: Iterable[str] = (),
+    public_ingress_scopes: dict[str, str] | Iterable[tuple[str, str]] = (),
 ) -> dict[str, Any]:
     scope = _slug(scope, "scope")
     pairs = environment_targets.items() if isinstance(environment_targets, dict) else environment_targets
@@ -92,6 +122,23 @@ def normalize_teardown_spec(
             raise DeploymentKitError(f"Duplicate environment target binding: {environment}")
         normalized_targets[environment] = target
 
+    ingress_pairs = (
+        public_ingress_scopes.items()
+        if isinstance(public_ingress_scopes, dict)
+        else public_ingress_scopes
+    )
+    normalized_ingress: dict[str, str] = {}
+    for environment, ingress_scope in ingress_pairs:
+        environment = _slug(environment, "environment")
+        ingress_scope = _slug(ingress_scope, "public ingress scope")
+        if environment not in normalized_targets:
+            raise DeploymentKitError(
+                f"public ingress scope binding {environment!r} has no matching environment target binding."
+            )
+        if environment in normalized_ingress:
+            raise DeploymentKitError(f"Duplicate public-ingress scope binding: {environment}")
+        normalized_ingress[environment] = ingress_scope
+
     if scope == "local":
         selected_targets: dict[str, str] = {}
     elif scope == "all":
@@ -107,15 +154,21 @@ def normalize_teardown_spec(
 
     production_set = _normalize_production_environments(production_environments)
     selected_production = sorted(set(selected_targets).intersection(production_set))
+    selected_ingress = {
+        environment: normalized_ingress[environment]
+        for environment in selected_targets
+        if environment in normalized_ingress
+    }
 
     return {
-        "schemaVersion": 2,
+        "schemaVersion": 3,
         "ownerRepo": _owner_repo(owner_repo),
         "appSlug": _slug(app_slug, "appSlug"),
         "scope": scope,
         "environmentTargets": selected_targets,
         "localPackage": package,
         "productionEnvironments": selected_production,
+        "publicIngressScopes": selected_ingress,
     }
 
 
@@ -124,6 +177,178 @@ def _find_route(inventory: dict[str, Any], app_slug: str, environment: str) -> d
     return next((item for item in inventory["managedRoutes"] if item["routeId"] == route_id), None)
 
 
+def _ensure_candidate(
+    candidates: dict[str, dict[str, Any]],
+    *,
+    owner_repo: str,
+    app_slug: str,
+    environment: str,
+    target_name: str,
+) -> dict[str, Any]:
+    route_id = f"{app_slug}--{environment}"
+    candidate = candidates.get(route_id)
+    if candidate is None:
+        candidate = {
+            "routeId": route_id,
+            "ownerRepo": owner_repo,
+            "appSlug": app_slug,
+            "environment": environment,
+            "targetName": target_name,
+            "runtime": None,
+            "trustedLanRoute": None,
+            "publicIngress": [],
+        }
+        candidates[route_id] = candidate
+        return candidate
+    if candidate["ownerRepo"] != owner_repo:
+        raise DeploymentKitError(
+            f"Target inventory ownership mismatch for {route_id}: "
+            f"{candidate['ownerRepo']} versus {owner_repo}."
+        )
+    return candidate
+
+
+def target_inventory(name: str, *, ingress_scopes: Iterable[str] = ()) -> dict[str, Any]:
+    """Read one target's shared platform and application-owned tear-down candidates."""
+    platform = platform_status(name)
+    apps_result = app_inventory(name)
+    lan_result = route_inventory(name)
+
+    candidates: dict[str, dict[str, Any]] = {}
+    inferred_scopes: set[str] = set()
+
+    for app in apps_result["applications"]:
+        candidate = _ensure_candidate(
+            candidates,
+            owner_repo=app["ownerRepo"],
+            app_slug=app["appSlug"],
+            environment=app["environment"],
+            target_name=name,
+        )
+        candidate["runtime"] = app
+        inferred_scopes.add(app["environment"])
+
+    for route in lan_result["managedRoutes"]:
+        candidate = _ensure_candidate(
+            candidates,
+            owner_repo=route["ownerRepo"],
+            app_slug=route["appSlug"],
+            environment=route["environment"],
+            target_name=name,
+        )
+        candidate["trustedLanRoute"] = route
+        inferred_scopes.add(route["environment"])
+
+    if isinstance(name, str) and _SLUG_RE.fullmatch(name):
+        inferred_scopes.add(name)
+    requested_scopes = {_slug(item, "public ingress scope") for item in ingress_scopes}
+    scopes = sorted(inferred_scopes | requested_scopes)
+
+    public_scopes: list[dict[str, Any]] = []
+    for scope in scopes:
+        status = cloudflare_ingress_status(name, scope)
+        routes: list[dict[str, Any]] = []
+        if status["markerPresent"]:
+            routes = cloudflare_route_inventory(name, scope)["managedRoutes"]
+            for route in routes:
+                candidate = _ensure_candidate(
+                    candidates,
+                    owner_repo=route["ownerRepo"],
+                    app_slug=route["appSlug"],
+                    environment=route["environment"],
+                    target_name=name,
+                )
+                candidate["publicIngress"].append({"scope": scope, **route})
+        public_scopes.append(
+            {
+                "scope": scope,
+                "state": status["state"],
+                "markerPresent": status["markerPresent"],
+                "managedRoutes": routes,
+            }
+        )
+
+    applications: list[dict[str, Any]] = []
+    for candidate in sorted(
+        candidates.values(),
+        key=lambda item: (item["appSlug"], item["environment"], item["ownerRepo"]),
+    ):
+        public_bindings = sorted(
+            {item["scope"] for item in candidate["publicIngress"]}
+        )
+        literal_production = candidate["environment"] == "production"
+        candidate["tearDown"] = {
+            "available": True,
+            "scope": candidate["environment"],
+            "environmentTarget": f"{candidate['environment']}={name}",
+            "publicIngressScopes": [
+                f"{candidate['environment']}={scope}" for scope in public_bindings
+            ],
+            "productionClassification": (
+                "production" if literal_production else "requires-trusted-evidence"
+            ),
+            "productionClassificationSource": (
+                "literal-environment-name" if literal_production else "not-encoded-in-target-inventory"
+            ),
+            "requiresProductionDataAuthorization": True if literal_production else None,
+            "requiresPublicIngressAuthorization": bool(public_bindings),
+        }
+        applications.append(candidate)
+
+    return {
+        "schemaVersion": 1,
+        "targetName": name,
+        "verifiedAddress": apps_result.get("verifiedAddress") or lan_result.get("verifiedAddress"),
+        "sharedPlatform": platform,
+        "applications": applications,
+        "publicIngressScopes": public_scopes,
+        "mutated": False,
+    }
+
+
+def _tear_down_public_ingress(
+    target: str,
+    scope: str,
+    owner_repo: str,
+    app_slug: str,
+    environment: str,
+) -> dict[str, Any]:
+    inventory = cloudflare_route_inventory(target, scope)
+    route = _find_route(inventory, app_slug, environment)
+    if route is None:
+        return {"state": "absent", "mutated": False, "scope": scope}
+    if (
+        route["ownerRepo"] != owner_repo
+        or route["appSlug"] != app_slug
+        or route["environment"] != environment
+    ):
+        raise DeploymentKitError(
+            f"Public route {app_slug}--{environment} ownership does not match the requested Project."
+        )
+    token = os.environ.get(CLOUDFLARE_API_TOKEN_ENV, "").strip()
+    if not token:
+        raise DeploymentKitError(
+            f"Cloudflare API authorization is required to remove owned public ingress. "
+            f"Set {CLOUDFLARE_API_TOKEN_ENV} in the current workstation process/secret boundary; "
+            "never put the token in the Project repository or command line."
+        )
+    plan = plan_public_route_removal(
+        target,
+        scope=scope,
+        owner_repo=owner_repo,
+        environment=environment,
+        app_slug=app_slug,
+        api_token=token,
+    )
+    result = apply_public_route_removal(plan, api_token=token)
+    return {
+        "state": "removed",
+        "mutated": bool(result.get("mutated")),
+        "scope": scope,
+        "publicHostname": route["publicHostname"],
+    }
+
+
 def _tear_down_route(target: str, owner_repo: str, app_slug: str, environment: str) -> dict[str, Any]:
     inventory = route_inventory(target)
     route = _find_route(inventory, app_slug, environment)
@@ -170,13 +395,18 @@ def _tear_down_remote_environment(
             "Remote Project tear-down failed: " + (stderr or stdout or f"exit {completed.returncode}")
         )
     parts = stdout.split("\t")
-    if len(parts) not in {4, 5} or parts[0] != "TEAR_DOWN" or parts[1] not in {"absent", "removed"}:
+    if len(parts) not in {4, 5, 7} or parts[0] != "TEAR_DOWN" or parts[1] not in {"absent", "removed"}:
         raise DeploymentKitError("Remote Project tear-down returned malformed evidence.")
     if parts[2] != app_slug or parts[3] != environment:
         raise DeploymentKitError("Remote Project tear-down returned mismatched app/environment evidence.")
     result: dict[str, Any] = {"state": parts[1], "mutated": parts[1] == "removed"}
-    if len(parts) == 5:
+    if len(parts) >= 5:
         result["containerName"] = parts[4]
+    if len(parts) == 7:
+        if parts[6] not in {"true", "false"}:
+            raise DeploymentKitError("Remote Project tear-down returned malformed image-removal evidence.")
+        result["images"] = [item for item in parts[5].split(",") if item]
+        result["allImagesRemoved"] = parts[6] == "true"
     return result
 
 
@@ -256,11 +486,21 @@ def tear_down_project(spec: dict[str, Any]) -> dict[str, Any]:
         environment_targets=(spec.get("environmentTargets") or {}).items(),
         local_package=spec.get("localPackage"),
         production_environments=spec.get("productionEnvironments") or (),
+        public_ingress_scopes=(spec.get("publicIngressScopes") or {}).items(),
     )
 
     environments: list[dict[str, Any]] = []
     mutated = False
     for environment, target in normalized["environmentTargets"].items():
+        public_ingress: dict[str, Any] = {"state": "not-selected", "mutated": False}
+        if environment in normalized["publicIngressScopes"]:
+            public_ingress = _tear_down_public_ingress(
+                target,
+                normalized["publicIngressScopes"][environment],
+                normalized["ownerRepo"],
+                normalized["appSlug"],
+                environment,
+            )
         route = _tear_down_route(target, normalized["ownerRepo"], normalized["appSlug"], environment)
         runtime = _tear_down_remote_environment(
             target,
@@ -268,11 +508,17 @@ def tear_down_project(spec: dict[str, Any]) -> dict[str, Any]:
             normalized["appSlug"],
             environment,
         )
-        mutated = mutated or route["mutated"] or runtime["mutated"]
+        mutated = (
+            mutated
+            or public_ingress["mutated"]
+            or route["mutated"]
+            or runtime["mutated"]
+        )
         environments.append(
             {
                 "environment": environment,
                 "targetName": target,
+                "publicIngress": public_ingress,
                 "route": route,
                 "runtimeAndPersistentData": runtime,
             }
@@ -284,7 +530,7 @@ def tear_down_project(spec: dict[str, Any]) -> dict[str, Any]:
         mutated = mutated or workstation["mutated"]
 
     return {
-        "schemaVersion": 2,
+        "schemaVersion": 3,
         "ownerRepo": normalized["ownerRepo"],
         "appSlug": normalized["appSlug"],
         "scope": normalized["scope"],
@@ -292,6 +538,8 @@ def tear_down_project(spec: dict[str, Any]) -> dict[str, Any]:
         "workstation": workstation,
         "productionEnvironments": normalized["productionEnvironments"],
         "productionDataIncluded": bool(normalized["productionEnvironments"]),
+        "publicIngressScopes": normalized["publicIngressScopes"],
+        "publicIngressIncluded": bool(normalized["publicIngressScopes"]),
         "mutated": mutated,
     }
 

package/assets/generated/deployment/src/project_forge_deployment/teardown_cli.py

@@ -3,15 +3,19 @@
 from __future__ import annotations
 
 import argparse
+import json
 import sys
 
 from .errors import DeploymentKitError
 from .teardown import (
     PRODUCTION_DATA_DELETE_PHRASE,
+    PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
     TEAR_DOWN_WRITE_PHRASE,
     normalize_teardown_spec,
+    parse_environment_scopes,
     parse_environment_targets,
     render_teardown_summary,
+    target_inventory,
     tear_down_project,
 )
 
@@ -22,7 +26,7 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
         description=(
             "Remove one named Kit-managed environment, all explicitly bound environments, "
             "and/or exact-package local Docker state. Remote tear-down deletes persistent "
-            "application data for selected environments."
+            "application data for selected environments while preserving shared Project Forge platform state."
         ),
     )
     parser.add_argument(
@@ -38,6 +42,16 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
         metavar="ENV=TARGET",
         help="Explicit named environment-to-target binding; repeat as needed.",
     )
+    parser.add_argument(
+        "--public-ingress-scope",
+        action="append",
+        default=[],
+        metavar="ENV=SCOPE",
+        help=(
+            "Optional exact environment-to-public-ingress-scope binding discovered from target inventory; "
+            "repeat as needed. Selected public routes are removed before LAN/runtime cleanup."
+        ),
+    )
     parser.add_argument(
         "--production-environment",
         action="append",
@@ -66,34 +80,84 @@ def parse_args(argv: list[str] | None = None) -> argparse.Namespace:
             f"{PRODUCTION_DATA_DELETE_PHRASE}"
         ),
     )
+    parser.add_argument(
+        "--public-ingress-authorization",
+        help=(
+            "Additional phrase required whenever selected environments include public ingress cleanup: "
+            f"{PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE}"
+        ),
+    )
     return parser.parse_args(argv)
 
 
 def _preview(spec: dict[str, object]) -> dict[str, object]:
     production = bool(spec["productionEnvironments"])
+    public_ingress = bool(spec["publicIngressScopes"])
     return {
-        "schemaVersion": 2,
+        "schemaVersion": 3,
         "ownerRepo": spec["ownerRepo"],
         "appSlug": spec["appSlug"],
         "scope": spec["scope"],
         "environmentTargets": spec["environmentTargets"],
+        "publicIngressScopes": spec["publicIngressScopes"],
         "localPackage": spec["localPackage"],
         "productionEnvironments": spec["productionEnvironments"],
         "destructive": True,
         "deletesPersistentData": bool(spec["environmentTargets"]),
         "deletesProductionData": production,
+        "removesPublicIngress": public_ingress,
+        "removesUnreferencedRemoteImages": bool(spec["environmentTargets"]),
         "preservesSharedPlatform": True,
+        "preservesSharedPublicIngressRuntime": True,
         "preservesUnrelatedProjects": True,
         "deletesGhcrPackage": False,
         "requiredAuthorization": TEAR_DOWN_WRITE_PHRASE,
         "requiredProductionDataAuthorization": PRODUCTION_DATA_DELETE_PHRASE if production else None,
+        "requiredPublicIngressAuthorization": (
+            PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE if public_ingress else None
+        ),
     }
 
 
+def inventory_main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        prog="project-forge-deploy target inventory",
+        description=(
+            "Read shared platform state plus application-owned resources that are valid tear-down candidates "
+            "on one target. This command is read-only and does not require a consumer repository."
+        ),
+    )
+    parser.add_argument("name", help="Logical Project Forge target profile")
+    parser.add_argument(
+        "--ingress-scope",
+        action="append",
+        default=[],
+        metavar="SCOPE",
+        help=(
+            "Additional public-ingress scope to inspect when it cannot be inferred from managed application "
+            "or LAN-route environment names; repeat as needed."
+        ),
+    )
+    parser.add_argument("--json", action="store_true")
+    try:
+        args = parser.parse_args(argv)
+        result = target_inventory(args.name, ingress_scopes=args.ingress_scope)
+        if args.json:
+            print(json.dumps(result, indent=2, sort_keys=True))
+        else:
+            print("TARGET INVENTORY")
+            print(json.dumps(result, indent=2, sort_keys=True))
+        return 0
+    except DeploymentKitError as exc:
+        print(f"ERROR: {exc}", file=sys.stderr)
+        return 2
+
+
 def main(argv: list[str] | None = None) -> int:
     try:
         args = parse_args(argv)
         bindings = parse_environment_targets(args.environment_target)
+        public_bindings = parse_environment_scopes(args.public_ingress_scope)
         spec = normalize_teardown_spec(
             owner_repo=args.owner_repo,
             app_slug=args.app_slug,
@@ -101,6 +165,7 @@ def main(argv: list[str] | None = None) -> int:
             environment_targets=bindings,
             local_package=args.local_package,
             production_environments=args.production_environment,
+            public_ingress_scopes=public_bindings,
         )
         preview = _preview(spec)
 
@@ -110,7 +175,12 @@ def main(argv: list[str] | None = None) -> int:
             needs_production
             and args.production_data_authorization != PRODUCTION_DATA_DELETE_PHRASE
         )
-        if missing_general or missing_production:
+        needs_public_ingress = bool(spec["publicIngressScopes"])
+        missing_public_ingress = (
+            needs_public_ingress
+            and args.public_ingress_authorization != PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE
+        )
+        if missing_general or missing_production or missing_public_ingress:
             print("PROJECT TEAR-DOWN PREVIEW")
             print(render_teardown_summary(preview))
             if missing_general:
@@ -124,6 +194,12 @@ def main(argv: list[str] | None = None) -> int:
                     f"--production-data-authorization {PRODUCTION_DATA_DELETE_PHRASE!r}",
                     file=sys.stderr,
                 )
+            if missing_public_ingress:
+                print(
+                    "ERROR: public-ingress removal requires "
+                    f"--public-ingress-authorization {PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE!r}",
+                    file=sys.stderr,
+                )
             return 2
 
         result = tear_down_project(spec)

package/assets/generated/deployment/src/project_forge_deployment/teardown_remote.py

@@ -10,6 +10,7 @@ ENVIRONMENT="$3"
 
 valid_slug() { [[ "$1" =~ ^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$ ]]; }
 valid_repo() { [[ "$1" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; }
+valid_image() { [[ "$1" =~ ^[A-Za-z0-9][A-Za-z0-9._/:+-]*@sha256:[0-9a-f]{64}$ ]]; }
 meta_value() {
     local path="$1" key="$2"
     [[ -f "$path" && ! -L "$path" ]] || return 1
@@ -22,6 +23,13 @@ assert_owned_marker() {
        "$(meta_value "$path" APP_SLUG || true)" == "$APP" && \
        "$(meta_value "$path" ENVIRONMENT || true)" == "$ENVIRONMENT" ]]
 }
+append_unique_image() {
+    local value="$1" existing
+    for existing in "${IMAGES[@]:-}"; do
+        [[ "$existing" == "$value" ]] && return 0
+    done
+    IMAGES+=("$value")
+}
 
 valid_repo "$OWNER" || { echo "Invalid owner repository." >&2; exit 20; }
 valid_slug "$APP" || { echo "Invalid application slug." >&2; exit 20; }
@@ -60,6 +68,23 @@ if [[ "$HAS_PERSISTENCE" == true ]] && ! assert_owned_marker "$PERSISTENCE"; the
 fi
 
 CONTAINER=""
+IMAGES=()
+if [[ -d "$ROOT/releases" && ! -L "$ROOT/releases" ]]; then
+    while IFS= read -r release_file; do
+        [[ -f "$release_file" && ! -L "$release_file" ]] || continue
+        assert_owned_marker "$release_file" || {
+            echo "Managed release ownership does not match selected environment: $release_file" >&2
+            exit 23
+        }
+        image="$(meta_value "$release_file" IMAGE || true)"
+        valid_image "$image" || {
+            echo "Managed release contains an invalid immutable image reference: $release_file" >&2
+            exit 23
+        }
+        append_unique_image "$image"
+    done < <(find "$ROOT/releases" -mindepth 2 -maxdepth 2 -type f -name release.env -print 2>/dev/null || true)
+fi
+
 if [[ "$HAS_STATE" == true ]]; then
     CURRENT_RELEASE="$(meta_value "$STATE" CURRENT_RELEASE || true)"
     [[ -n "$CURRENT_RELEASE" && "$CURRENT_RELEASE" != */* && "$CURRENT_RELEASE" != *..* ]] || {
@@ -96,5 +121,37 @@ if [[ -d "$APP_DIR" ]] && ! find "$APP_DIR" -mindepth 1 -print -quit | grep -q .
     rmdir "$APP_DIR"
 fi
 
-printf 'TEAR_DOWN\tremoved\t%s\t%s\t%s\n' "$APP" "$ENVIRONMENT" "$CONTAINER"
+RETAINED_IMAGE=false
+for IMAGE in "${IMAGES[@]:-}"; do
+    [[ -n "$IMAGE" ]] || continue
+    IMAGE_REFERENCED_ELSEWHERE=false
+    while IFS= read -r candidate; do
+        [[ -f "$candidate" && ! -L "$candidate" ]] || continue
+        if [[ "$(meta_value "$candidate" IMAGE || true)" == "$IMAGE" ]]; then
+            IMAGE_REFERENCED_ELSEWHERE=true
+            break
+        fi
+    done < <(find "$APP_ROOT" -mindepth 5 -maxdepth 5 -type f -name release.env -print 2>/dev/null || true)
+
+    if [[ "$IMAGE_REFERENCED_ELSEWHERE" == true ]] || \
+       docker ps -a --filter "ancestor=$IMAGE" --format '{{.ID}}' | grep -q .; then
+        RETAINED_IMAGE=true
+        continue
+    fi
+    if docker image inspect "$IMAGE" >/dev/null 2>&1; then
+        if ! docker image rm "$IMAGE" >/dev/null 2>&1; then
+            RETAINED_IMAGE=true
+        fi
+    fi
+done
+
+IMAGES_CSV=""
+if [[ ${#IMAGES[@]} -gt 0 ]]; then
+    IMAGES_CSV="$(IFS=,; echo "${IMAGES[*]}")"
+fi
+ALL_IMAGES_REMOVED=true
+[[ "$RETAINED_IMAGE" == true ]] && ALL_IMAGES_REMOVED=false
+
+printf 'TEAR_DOWN\tremoved\t%s\t%s\t%s\t%s\t%s\n' \
+    "$APP" "$ENVIRONMENT" "$CONTAINER" "$IMAGES_CSV" "$ALL_IMAGES_REMOVED"
 '''

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.8.1",
+  "version": "4.10.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {