@omnitron-dev/omnitron 0.2.0 → 0.3.1

package/dist/commands/deploy.d.ts

@@ -1,17 +1,79 @@
 /**
- * omnitron deploy <app> --target <server|tag> — Deploy app to remote server
  * omnitron deploy build <app> — Build deployment artifact (tarball)
- * omnitron rollback <app> --target <server> — Rollback to previous version
+ *
+ * `deploy app` and `rollback` are refused here. Both used to call
+ * `restartApp` on a remote daemon — the same call, under two names, each
+ * announcing an operation it did not perform. Deployment is
+ * `omnitron stack start`; see the notes on each function.
  */
 /**
  * Build a deployment artifact for an app.
  * Uses DependencyAnalyzer to find all workspace deps and ArtifactBuilder to create tarball.
  */
 export declare function projectBuildCommand(app: string): Promise<void>;
-export declare function deployCommand(app: string, opts: {
-    target: string;
-}): Promise<void>;
-export declare function rollbackCommand(app: string, opts: {
-    target: string;
-}): Promise<void>;
+/**
+ * `omnitron deploy app <app>` — not implemented; says so, and where deployment is.
+ *
+ * What this used to do: connect to the remote daemon and call
+ * `restartApp({ name: app })`, then print `Deployed '<app>' to <alias>`. No
+ * artifact was built, nothing was transferred, nothing was installed. The
+ * `--strategy rolling|blue-green|canary` and `--version` flags were accepted
+ * and read by nothing.
+ *
+ * `rollback` was the SAME call — byte for byte the same operation under a
+ * different name — and printed `Rolled back`. A rollback is a control you
+ * reach for when something is already wrong; discovering at that moment that
+ * it only restarts the version you are trying to get away from is the most
+ * expensive time to discover it.
+ *
+ * Deployment in this system is a STACK operation, and it is implemented:
+ * `stack start` provisions the node, builds and ships the artifact over SSH,
+ * installs dependencies and verifies health. This command belonged to a
+ * different, unfinished model — one app to one server by alias — that never
+ * had a deployer behind it.
+ *
+ * The refusal that replaced it was wrong in three places, measured
+ * 2026-09-23. It exited 0, so a script took it for a deployment. It said the
+ * remote path «has never been executed» and that «no project config declares
+ * `stacks.nodes`» — while `sample/test` declares one node and the audit trail
+ * held 28 `stack.start sample/test` rows from an operator, 5 of them that day.
+ * And it sent the reader to `omnitron remote restart <alias>` — a restart,
+ * not a deployment, on a registry that answered «No remote servers
+ * registered». The `--target` flag existed only to fill in that line.
+ *
+ * What it says now is what works today: `stack start`, and for a stack that
+ * takes releases only, the two commands its own refusal names
+ * (`ProjectService`, «takes releases only»).
+ */
+export declare function deployCommand(app: string): Promise<void>;
+/**
+ * `omnitron rollback <app>` — not implemented; names the rollback that exists.
+ *
+ * It called `restartApp` — the identical operation to `deploy`, restarting
+ * the running version. There is no version history behind this path.
+ *
+ * Its refusal, measured 2026-09-23, opened with «does not roll back: it
+ * restarted the running version of 'main'» — read on its own, a report that
+ * `main` had just been restarted, from a command that does nothing. It exited
+ * 0. It said the stack deployer «has itself never been executed», against 28
+ * operator `stack.start sample/test` rows in the audit trail. It said artifacts
+ * «are kept per version on the node»: the node's path is
+ * `/opt/omnitron/artifacts/<project>/<app>/<version>` (remote-deployer), the
+ * version is the app's package.json version, and every app in all 23 release
+ * manifests on this machine is 0.0.1 — one directory per app, which each
+ * deployment overwrites (from the code; not checked on a node). And its
+ * advice, `omnitron stack start <project> <stack>`, is refused without
+ * `--release` by a stack that takes releases only, as `sample/test` does.
+ *
+ * The rollback that does exist is the release before, for a remote stack
+ * (a local one takes no release: `admitRelease`). Releases are kept where
+ * they were built or pulled, not on the node; `stack start --release` ships
+ * the release's own artifacts, onto a running stack too
+ * (`ProjectService.startStackOnce`: «putting a release onto a running stack
+ * is the point»), and the node installs any artifact whose checksum differs
+ * from what it has. So `release list`, then `stack start --release` with the
+ * previous id, is the way back — read from the code, not exercised here as a
+ * rollback.
+ */
+export declare function rollbackCommand(app: string): Promise<void>;
 //# sourceMappingURL=deploy.d.ts.map

package/dist/commands/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAyCpE;AAED,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA8BxF;AAED,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4B1F"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA2CpE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAgB9D;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhE"}

package/dist/commands/deploy.js

@@ -1,11 +1,13 @@
 /**
- * omnitron deploy <app> --target <server|tag> — Deploy app to remote server
  * omnitron deploy build <app> — Build deployment artifact (tarball)
- * omnitron rollback <app> --target <server> — Rollback to previous version
+ *
+ * `deploy app` and `rollback` are refused here. Both used to call
+ * `restartApp` on a remote daemon — the same call, under two names, each
+ * announcing an operation it did not perform. Deployment is
+ * `omnitron stack start`; see the notes on each function.
  */
-import { log, spinner } from '@xec-sh/kit';
-import { ServerRegistry } from '../infrastructure/server-registry.js';
-import { createRemoteDaemonClient } from '../daemon/daemon-client.js';
+import { log } from '@xec-sh/kit';
+import { spinner } from './spinner.js';
 /**
  * Build a deployment artifact for an app.
  * Uses DependencyAnalyzer to find all workspace deps and ArtifactBuilder to create tarball.
@@ -18,6 +20,8 @@ export async function projectBuildCommand(app) {
     const entry = config.apps.find((a) => a.name === app);
     if (!entry) {
         log.error(`Unknown app: ${app}. Available: ${config.apps.map((a) => a.name).join(', ')}`);
+        // It built nothing and exited 0, as the two refusals below did.
+        process.exitCode = 1;
         return;
     }
     const cwd = process.cwd();
@@ -46,65 +50,96 @@ export async function projectBuildCommand(app) {
     log.info(`  Checksum: ${artifact.checksum.slice(0, 16)}...`);
     log.info(`  Built at: ${artifact.builtAt}`);
 }
-export async function deployCommand(app, opts) {
-    if (!opts.target) {
-        log.error('--target is required (server alias or tag)');
-        return;
-    }
-    const registry = new ServerRegistry();
-    const servers = resolveTargetServers(registry, opts.target);
-    if (servers.length === 0) {
-        log.error(`No servers found for target '${opts.target}'`);
-        return;
-    }
-    log.info(`Deploying '${app}' to ${servers.length} server(s): ${servers.map((s) => s.alias).join(', ')}`);
-    for (const server of servers) {
-        const s = spinner();
-        s.start(`Deploying '${app}' to ${server.alias}...`);
-        const client = createRemoteDaemonClient(server.host, server.port);
-        try {
-            const daemon = await client.service('OmnitronDaemon');
-            await daemon.restartApp({ name: app });
-            s.stop(`Deployed '${app}' to ${server.alias}`);
-        }
-        catch (err) {
-            s.stop(`Failed to deploy to ${server.alias}: ${err.message}`);
-        }
-        await client.disconnect();
-    }
-}
-export async function rollbackCommand(app, opts) {
-    if (!opts.target) {
-        log.error('--target is required');
-        return;
-    }
-    const registry = new ServerRegistry();
-    const servers = resolveTargetServers(registry, opts.target);
-    if (servers.length === 0) {
-        log.error(`No servers found for target '${opts.target}'`);
-        return;
-    }
-    for (const server of servers) {
-        const s = spinner();
-        s.start(`Rolling back '${app}' on ${server.alias}...`);
-        const client = createRemoteDaemonClient(server.host, server.port);
-        try {
-            const daemon = await client.service('OmnitronDaemon');
-            await daemon.restartApp({ name: app });
-            s.stop(`Rolled back '${app}' on ${server.alias}`);
-        }
-        catch (err) {
-            s.stop(`Rollback failed on ${server.alias}: ${err.message}`);
-        }
-        await client.disconnect();
-    }
+/**
+ * `omnitron deploy app <app>` — not implemented; says so, and where deployment is.
+ *
+ * What this used to do: connect to the remote daemon and call
+ * `restartApp({ name: app })`, then print `Deployed '<app>' to <alias>`. No
+ * artifact was built, nothing was transferred, nothing was installed. The
+ * `--strategy rolling|blue-green|canary` and `--version` flags were accepted
+ * and read by nothing.
+ *
+ * `rollback` was the SAME call — byte for byte the same operation under a
+ * different name — and printed `Rolled back`. A rollback is a control you
+ * reach for when something is already wrong; discovering at that moment that
+ * it only restarts the version you are trying to get away from is the most
+ * expensive time to discover it.
+ *
+ * Deployment in this system is a STACK operation, and it is implemented:
+ * `stack start` provisions the node, builds and ships the artifact over SSH,
+ * installs dependencies and verifies health. This command belonged to a
+ * different, unfinished model — one app to one server by alias — that never
+ * had a deployer behind it.
+ *
+ * The refusal that replaced it was wrong in three places, measured
+ * 2026-09-23. It exited 0, so a script took it for a deployment. It said the
+ * remote path «has never been executed» and that «no project config declares
+ * `stacks.nodes`» — while `sample/test` declares one node and the audit trail
+ * held 28 `stack.start sample/test` rows from an operator, 5 of them that day.
+ * And it sent the reader to `omnitron remote restart <alias>` — a restart,
+ * not a deployment, on a registry that answered «No remote servers
+ * registered». The `--target` flag existed only to fill in that line.
+ *
+ * What it says now is what works today: `stack start`, and for a stack that
+ * takes releases only, the two commands its own refusal names
+ * (`ProjectService`, «takes releases only»).
+ */
+export async function deployCommand(app) {
+    log.error(`\`omnitron deploy app\` is not implemented: nothing was deployed.`);
+    log.info('');
+    log.info('Deployment is a stack operation:');
+    log.info('');
+    log.info('    omnitron stack start <project> <stack>');
+    log.info('');
+    log.info("A stack whose config says `release: { mode: 'required' }` takes releases only:");
+    log.info('');
+    log.info('    omnitron release build <project> --for <stack>');
+    log.info('    omnitron stack start <project> <stack> --release <id>');
+    log.info('');
+    log.info('To build an artifact without shipping it:');
+    log.info('');
+    log.info(`    omnitron deploy build ${app}`);
+    process.exitCode = 1;
 }
-function resolveTargetServers(registry, target) {
-    // First try as alias
-    const byAlias = registry.get(target);
-    if (byAlias)
-        return [byAlias];
-    // Then try as tag
-    return registry.list().filter((s) => s.tags.includes(target));
+/**
+ * `omnitron rollback <app>` — not implemented; names the rollback that exists.
+ *
+ * It called `restartApp` — the identical operation to `deploy`, restarting
+ * the running version. There is no version history behind this path.
+ *
+ * Its refusal, measured 2026-09-23, opened with «does not roll back: it
+ * restarted the running version of 'main'» — read on its own, a report that
+ * `main` had just been restarted, from a command that does nothing. It exited
+ * 0. It said the stack deployer «has itself never been executed», against 28
+ * operator `stack.start sample/test` rows in the audit trail. It said artifacts
+ * «are kept per version on the node»: the node's path is
+ * `/opt/omnitron/artifacts/<project>/<app>/<version>` (remote-deployer), the
+ * version is the app's package.json version, and every app in all 23 release
+ * manifests on this machine is 0.0.1 — one directory per app, which each
+ * deployment overwrites (from the code; not checked on a node). And its
+ * advice, `omnitron stack start <project> <stack>`, is refused without
+ * `--release` by a stack that takes releases only, as `sample/test` does.
+ *
+ * The rollback that does exist is the release before, for a remote stack
+ * (a local one takes no release: `admitRelease`). Releases are kept where
+ * they were built or pulled, not on the node; `stack start --release` ships
+ * the release's own artifacts, onto a running stack too
+ * (`ProjectService.startStackOnce`: «putting a release onto a running stack
+ * is the point»), and the node installs any artifact whose checksum differs
+ * from what it has. So `release list`, then `stack start --release` with the
+ * previous id, is the way back — read from the code, not exercised here as a
+ * rollback.
+ */
+export async function rollbackCommand(app) {
+    log.error(`\`omnitron rollback\` is not implemented: nothing was done to '${app}'.`);
+    log.info('');
+    log.info('The way back for a remote stack is the previous release:');
+    log.info('');
+    log.info('    omnitron release list');
+    log.info('    omnitron stack start <project> <stack> --release <previous-release-id>');
+    log.info('');
+    log.info("The project checkout must be at that release's project commit");
+    log.info('(`omnitron release show <id>` names it); `stack start` refuses, naming it, when it is not.');
+    process.exitCode = 1;
 }
 //# sourceMappingURL=deploy.js.map

package/dist/commands/deploy.js.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,sCAAsC,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAEtE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IAEpB,yCAAyC;IACzC,CAAC,CAAC,KAAK,CAAC,yCAAyC,GAAG,MAAM,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,aAAa,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAErE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,YAAY,CAAC,MAAM,eAAe,CAAC,CAAC;IAElE,yBAAyB;IACzB,CAAC,CAAC,KAAK,CAAC,0BAA0B,GAAG,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,KAAK,CAAC,CAAC;IACjC,GAAG,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7D,GAAG,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAwB;IACvE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACxD,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,cAAc,GAAG,QAAQ,OAAO,CAAC,MAAM,eAAe,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEzG,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,cAAc,GAAG,QAAQ,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqD,gBAAgB,CAAC,CAAC;YAC1G,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,aAAa,GAAG,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW,EAAE,IAAwB;IACzE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAClC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,cAAc,EAAE,CAAC;IACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE5D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,GAAG,CAAC,KAAK,CAAC,gCAAgC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1D,OAAO;IACT,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,CAAC,CAAC,KAAK,CAAC,iBAAiB,GAAG,QAAQ,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAClE,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAqD,gBAAgB,CAAC,CAAC;YAC1G,MAAM,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;YACvC,CAAC,CAAC,IAAI,CAAC,gBAAgB,GAAG,QAAQ,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,CAAC,CAAC,IAAI,CAAC,sBAAsB,MAAM,CAAC,KAAK,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAwB,EAAE,MAAc;IACpE,qBAAqB;IACrB,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,OAAO;QAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IAE9B,kBAAkB;IAClB,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"deploy.js","sourceRoot":"","sources":["../../src/commands/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAW;IACnD,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;IACpE,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,mCAAmC,CAAC,CAAC;IACjF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;IAE3E,MAAM,MAAM,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,GAAG,CAAC,KAAK,CAAC,gBAAgB,GAAG,gBAAgB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC1F,gEAAgE;QAChE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;IAEpB,yCAAyC;IACzC,CAAC,CAAC,KAAK,CAAC,yCAAyC,GAAG,MAAM,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,IAAI,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS;QAC7B,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;QAC3C,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,GAAG,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,aAAa,CAAC,MAAM,yBAAyB,CAAC,CAAC;IAErE,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,KAAK,CAAC,GAAG,CAAC,YAAY,GAAG,CAAC,CAAC;IACjE,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,eAAe,KAAK,CAAC,YAAY,CAAC,MAAM,eAAe,CAAC,CAAC;IAElE,yBAAyB;IACzB,CAAC,CAAC,KAAK,CAAC,0BAA0B,GAAG,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC,CAAC,IAAI,CAAC,mBAAmB,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,GAAG,CAAC,IAAI,CAAC,cAAc,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,WAAW,MAAM,KAAK,CAAC,CAAC;IACjC,GAAG,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IAC7D,GAAG,CAAC,IAAI,CAAC,eAAe,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW;IAC7C,GAAG,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;IAC/E,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IACvD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC3F,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,oDAAoD,CAAC,CAAC;IAC/D,GAAG,CAAC,IAAI,CAAC,2DAA2D,CAAC,CAAC;IACtE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;IAC7C,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,GAAG,CAAC,KAAK,CAAC,kEAAkE,GAAG,IAAI,CAAC,CAAC;IACrF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACrE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACtC,GAAG,CAAC,IAAI,CAAC,4EAA4E,CAAC,CAAC;IACvF,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACb,GAAG,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;IAC1E,GAAG,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;IACvG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC"}

package/dist/commands/discover.d.ts

@@ -1,9 +1,30 @@
 /**
- * omnitron discover — Scan Docker + SSH for Omnitron-managed targets
+ * omnitron discover — what Omnitron manages: this machine's containers, and
+ * the registered nodes with how each one is reached.
  *
- * Discovers:
- * - Docker containers with 'omnitron.managed=true' label
- * - SSH-reachable hosts from fleet node registry
+ * Measured 2026-09-23 on the master, every field of the old output was one
+ * nothing had measured:
+ *
+ *   - all twelve containers `discovered` (in red, in a TTY), `PORT 0`, id
+ *     `docker:sample-` — the service filled state and port with constants and
+ *     this cut the synthetic id `docker:<name>` to twelve characters;
+ *   - «SSH Nodes» listed `127.0.0.1:9700` — the master itself, from the
+ *     control-plane table — and not sample-test, the one remote node, because
+ *     an unreachable probe was dropped rather than reported;
+ *   - it compared against `running` and `reachable`, values that never
+ *     arrived, so every row was red;
+ *   - both tables printed before the box that was meant to hold them, under
+ *     their own headers;
+ *   - the empty case sent the operator to `omnitron remote add`, a registry
+ *     this command does not read.
+ *
+ * Now the containers carry their real state, health and published ports,
+ * and the nodes come from the node registry — the one `node list` and the
+ * console read — with the mesh's account of how each is reached.
  */
+import type { OmnitronDiscoveredTarget } from '../shared/dto/discovery.js';
+import type { IMeshNodeStatus, INodeWithStatus } from '../shared/dto/nodes.js';
+export declare function printContainers(containers: readonly OmnitronDiscoveredTarget[]): void;
+export declare function printNodes(nodes: readonly INodeWithStatus[], mesh: readonly IMeshNodeStatus[]): void;
 export declare function discoverCommand(): Promise<void>;
 //# sourceMappingURL=discover.d.ts.map

package/dist/commands/discover.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/commands/discover.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAwFrD"}
+{"version":3,"file":"discover.d.ts","sourceRoot":"","sources":["../../src/commands/discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAMH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAE3E,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAwB/E,wBAAgB,eAAe,CAAC,UAAU,EAAE,SAAS,wBAAwB,EAAE,GAAG,IAAI,CA6BrF;AAeD,wBAAgB,UAAU,CAAC,KAAK,EAAE,SAAS,eAAe,EAAE,EAAE,IAAI,EAAE,SAAS,eAAe,EAAE,GAAG,IAAI,CAiCpG;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAqCrD"}

package/dist/commands/discover.js

@@ -1,124 +1,177 @@
 /**
- * omnitron discover — Scan Docker + SSH for Omnitron-managed targets
+ * omnitron discover — what Omnitron manages: this machine's containers, and
+ * the registered nodes with how each one is reached.
  *
- * Discovers:
- * - Docker containers with 'omnitron.managed=true' label
- * - SSH-reachable hosts from fleet node registry
+ * Measured 2026-09-23 on the master, every field of the old output was one
+ * nothing had measured:
+ *
+ *   - all twelve containers `discovered` (in red, in a TTY), `PORT 0`, id
+ *     `docker:sample-` — the service filled state and port with constants and
+ *     this cut the synthetic id `docker:<name>` to twelve characters;
+ *   - «SSH Nodes» listed `127.0.0.1:9700` — the master itself, from the
+ *     control-plane table — and not sample-test, the one remote node, because
+ *     an unreachable probe was dropped rather than reported;
+ *   - it compared against `running` and `reachable`, values that never
+ *     arrived, so every row was red;
+ *   - both tables printed before the box that was meant to hold them, under
+ *     their own headers;
+ *   - the empty case sent the operator to `omnitron remote add`, a registry
+ *     this command does not read.
+ *
+ * Now the containers carry their real state, health and published ports,
+ * and the nodes come from the node registry — the one `node list` and the
+ * console read — with the mesh's account of how each is reached.
  */
-import { box, log, prism, table } from '@xec-sh/kit';
+import { log, prism, table } from '@xec-sh/kit';
 import { createDaemonClient } from '../daemon/daemon-client.js';
+import { listManagedContainers } from '../infrastructure/container-runtime.js';
+import { containerTarget } from '../services/discovery.service.js';
+import { describeAbsence } from './daemon-required.js';
+import { formatCheckedAt, formatDaemon } from './node.js';
+/** A container's state in the colour it deserves — green only for running. */
+function colourState(state) {
+    if (state === 'running')
+        return prism.green(state);
+    if (state === 'exited' || state === 'dead')
+        return prism.red(state);
+    return prism.yellow(state);
+}
+function colourHealth(health) {
+    if (health === 'healthy')
+        return prism.green(health);
+    if (health === 'unhealthy')
+        return prism.red(health);
+    if (health === 'starting')
+        return prism.yellow(health);
+    return prism.dim('-');
+}
+/** Published ports as `host→container/proto`, or `-` when there are none. */
+function formatPorts(ports) {
+    const entries = Object.entries((ports ?? {}));
+    return entries.length > 0 ? entries.map(([inner, host]) => `${host}→${inner}`).join(', ') : '-';
+}
+export function printContainers(containers) {
+    if (containers.length === 0) {
+        log.info(prism.dim('No Omnitron-managed containers on this machine (label omnitron.managed=true).'));
+        return;
+    }
+    log.info(prism.bold(`Containers on this machine (${containers.length})`));
+    table({
+        width: 'auto',
+        data: containers.map((t) => {
+            const project = t.labels?.['omnitron.project'];
+            const stack = t.labels?.['omnitron.stack'];
+            return {
+                name: t.name,
+                stack: project && stack ? `${project}/${stack}` : '-',
+                state: colourState(t.status),
+                health: colourHealth(String(t.metadata?.['health'] ?? 'none')),
+                ports: formatPorts(t.metadata?.['ports']),
+                id: t.id.slice(0, 12),
+            };
+        }),
+        columns: [
+            { key: 'name', header: 'NAME' },
+            { key: 'stack', header: 'STACK' },
+            { key: 'state', header: 'STATE' },
+            { key: 'health', header: 'HEALTH' },
+            { key: 'ports', header: 'PUBLISHED' },
+            { key: 'id', header: 'ID' },
+        ],
+    });
+}
+/** How the master's mesh reaches a node, in words, in the colour it deserves. */
+function describeReach(mesh) {
+    if (!mesh || !mesh.inMesh)
+        return prism.dim('not in the mesh');
+    const via = mesh.via ? ` via ${mesh.via}` : '';
+    if (mesh.status === 'connected') {
+        return mesh.authenticated
+            ? prism.green(`mesh${via}, authenticated`)
+            : prism.yellow(`mesh${via}, NOT authenticated — pings only, no data`);
+    }
+    if (mesh.status === 'error')
+        return prism.red(`mesh error${mesh.lastError ? `: ${mesh.lastError}` : ''}`);
+    return prism.yellow(`mesh ${mesh.status}${via}`);
+}
+export function printNodes(nodes, mesh) {
+    // The local node is this machine — the one doing the discovering.
+    const remote = nodes.filter((n) => !n.isLocal);
+    if (remote.length === 0) {
+        log.info(prism.dim('No remote nodes registered. Add one with `omnitron node add` (the console\'s Nodes page uses the same registry).'));
+        return;
+    }
+    const byId = new Map(mesh.map((m) => [m.nodeId, m]));
+    log.info(prism.bold(`Registered nodes (${remote.length})`));
+    table({
+        width: 'auto',
+        data: remote.map((n) => {
+            const m = byId.get(n.id);
+            return {
+                name: n.name,
+                address: `${n.host}:${n.daemonPort}`,
+                reached: describeReach(m),
+                heartbeat: m?.lastHeartbeat ? formatCheckedAt(new Date(m.lastHeartbeat).toISOString()) : '-',
+                daemon: `${formatDaemon(n.status)}, checked ${formatCheckedAt(n.status?.checkedAt)}`,
+            };
+        }),
+        columns: [
+            { key: 'name', header: 'NODE' },
+            { key: 'address', header: 'DAEMON ADDRESS' },
+            { key: 'reached', header: 'REACHED' },
+            { key: 'heartbeat', header: 'HEARTBEAT' },
+            { key: 'daemon', header: 'LAST CHECK' },
+        ],
+    });
+}
 export async function discoverCommand() {
     const client = createDaemonClient();
-    if (!(await client.isReachable())) {
-        // Offline mode: basic Docker discovery without daemon
-        log.warn('Daemon is not running — performing local Docker discovery only');
-        await localDockerDiscovery();
+    const absence = await client.whyUnreachable();
+    if (absence) {
+        // Offline mode: this machine's containers are still readable without the
+        // daemon; the registered nodes live in its registry and are not.
+        log.warn(`${describeAbsence(absence)} — listing this machine's containers only; registered nodes need the daemon`);
+        await localContainerDiscovery();
         await client.disconnect();
         return;
     }
     try {
-        // Use OmnitronDiscovery RPC service via daemon
-        // The daemon-client only exposes IDaemonService, so we use exec to call
-        // the OmnitronDiscovery service methods via the generic exec RPC
-        const result = await client.exec({
-            name: '__daemon__',
-            service: 'OmnitronDiscovery',
-            method: 'scanAll',
-            args: [],
-        });
-        const scan = result;
-        const lines = [];
-        // Docker containers
-        if (scan.docker?.length > 0) {
-            lines.push(prism.bold('Docker Containers'));
-            lines.push('');
-            table({
-                data: scan.docker.map((t) => ({
-                    name: t.name,
-                    status: t.status === 'running' ? prism.green(t.status) : prism.red(t.status),
-                    address: t.address,
-                    port: t.port ?? '-',
-                    id: t.id.slice(0, 12),
-                })),
-                columns: [
-                    { key: 'name', header: 'NAME' },
-                    { key: 'status', header: 'STATUS' },
-                    { key: 'address', header: 'ADDRESS' },
-                    { key: 'port', header: 'PORT' },
-                    { key: 'id', header: 'ID' },
-                ],
-            });
-        }
-        else {
-            lines.push(prism.dim('No Docker containers found with omnitron.managed=true'));
-        }
-        lines.push('');
-        // SSH nodes
-        if (scan.ssh?.length > 0) {
-            lines.push(prism.bold('SSH Nodes'));
-            lines.push('');
-            table({
-                data: scan.ssh.map((t) => ({
-                    name: t.name,
-                    status: t.status === 'reachable' ? prism.green(t.status) : prism.red(t.status),
-                    address: t.address,
-                    port: t.port ?? 9700,
-                })),
-                columns: [
-                    { key: 'name', header: 'HOST' },
-                    { key: 'status', header: 'STATUS' },
-                    { key: 'address', header: 'ADDRESS' },
-                    { key: 'port', header: 'PORT' },
-                ],
-            });
-        }
-        else {
-            lines.push(prism.dim('No SSH nodes registered (use `omnitron remote add` to register nodes)'));
-        }
-        lines.push('');
-        lines.push(prism.dim(`Scan completed in ${scan.duration ?? 0}ms`));
-        box(lines.join('\n'), 'Discovery Scan');
+        const started = Date.now();
+        // Call the daemon-exposed peer services directly. (`exec` routes to an
+        // *app* handle via getHandle(name); '__daemon__' is not an app, so it
+        // 404s — the daemon's own services are reached with service().)
+        const discovery = await client.service('OmnitronDiscovery');
+        const nodesService = await client.service('OmnitronNodes');
+        const [containers, nodes, mesh] = await Promise.all([
+            discovery.discoverContainers(),
+            nodesService.listNodes(),
+            nodesService.getMeshStatus(),
+        ]);
+        printContainers(containers);
+        log.info('');
+        printNodes(nodes, mesh);
+        log.info(prism.dim(`Scanned in ${Date.now() - started}ms`));
     }
     catch (err) {
-        // Fallback: direct scan if exec to OmnitronDiscovery fails
         log.warn(`RPC discovery unavailable: ${err.message}`);
-        log.info('Falling back to local Docker discovery');
-        await localDockerDiscovery();
+        log.info('Falling back to local container discovery');
+        await localContainerDiscovery();
+    }
+    finally {
+        await client.disconnect();
     }
-    await client.disconnect();
 }
 /**
- * Fallback: scan Docker directly without daemon.
+ * This machine's containers, read without the daemon — through the same
+ * runtime call the daemon makes, so the two outputs are the same shape.
  */
-async function localDockerDiscovery() {
+async function localContainerDiscovery() {
     try {
-        const { execSync } = await import('node:child_process');
-        const output = execSync('docker ps --filter "label=omnitron.managed=true" --format "{{.ID}}\\t{{.Names}}\\t{{.Status}}\\t{{.Ports}}"', { encoding: 'utf-8', timeout: 10_000 }).trim();
-        if (!output) {
-            log.info('No Docker containers found with omnitron.managed=true label');
-            return;
-        }
-        const containers = output.split('\n').map((line) => {
-            const [id = '', name = '', status = '', ports = ''] = line.split('\t');
-            return {
-                id: id.slice(0, 12),
-                name,
-                status: status.includes('Up') ? prism.green('running') : prism.red('stopped'),
-                ports: ports || '-',
-            };
-        });
-        table({
-            data: containers,
-            columns: [
-                { key: 'name', header: 'NAME' },
-                { key: 'status', header: 'STATUS' },
-                { key: 'ports', header: 'PORTS' },
-                { key: 'id', header: 'ID' },
-            ],
-        });
+        printContainers((await listManagedContainers({ orThrow: true })).map(containerTarget));
     }
-    catch {
-        log.error('Docker is not available or not running');
+    catch (err) {
+        log.error(`Docker is not available or not running: ${err.message}`);
+        process.exitCode = 1;
     }
 }
 //# sourceMappingURL=discover.js.map